Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/6/2019
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Debuts ElectionGuard to Secure Voting Processes

The new software development kit - free and open source - will be available to election officials and technology suppliers this summer.

Microsoft today debuted ElectionGuard, a free, open source software development kit (SDK) aiming to protect political voting processes as the spotlight on election security grows harsher.

CEO Satya Nadella announced ElectionGuard during his keynote at the Build developer conference, this week in Seattle. The SDK, built in partnership with security company Galois, is designed to make the election process more secure by providing verification throughout elections and letting third parties securely validate results, among other capabilities.

ElectionGuard isn't a voting machine, and it's not intended to replace paper ballots or support Internet voting. It's built to secure current systems that rely on modern voting technology and serve as a platform for new systems to protect against tampering. Microsoft's goal here is to give officials a means to handle and organize votes while letting individuals verify their votes. People can verify their votes were correctly recorded and that recorded votes were properly counted.

Verification happens in two ways: Each voter gets a tracker with a code that can be used to follow an encrypted version of his or her vote throughout the election. Voters also can see their selections on a Web portal provided by authorities; however, once a vote is cast, neither the tracker nor portal data can be used to reveal the vote. After the election, these codes can be used to confirm votes were not changed and were included in the total count.

The tool includes an open specification, or "road map," as Microsoft puts it, which lets voters and candidates run verifiers to confirm the recorded votes have been accurately counted. It relies on homomorphic encryption, which lets mathematical procedures be done to encrypted data. This lets individually encrypted votes be combined to form an encrypted vote count, which can be decrypted to view a full tally that protects voter privacy. Someone who runs an open election verifier can confirm encrypted votes were aggregated and the encrypted tabulation has been decrypted to get the final count.

[Hear Microsoft's Shawn Anderson, executive security adviser, present Crash Course: Principles of Endpoint Defense, at Interop 2019 next month]

"This process allows anyone to verify the correct counting of votes by inspecting the public election record, while keeping voting records secure," writes Tom Burt, corporate vice president of customer security and trust, in a blog post on the news. "The use of homomorphic encryption to enable verification is separate from and in addition to the process of paper ballots counted as an official election tally."

If a vote needs to be audited, ElectionGuard lets officials compare random ballot records with corresponding paper ballots to confirm a match. By comparing paper with digital records, fewer ballots would be necessary to ascertain confidence in an election, Burt explains.

ElectionGuard will be available this summer to election officials and technology suppliers so they can incorporate it into voting systems. Microsoft also has teamed up with election tech suppliers to explore integration of ElectionGuard into voting systems. It reports it has existing partnerships with suppliers responsible for more than half of the voting machines in the US.

This tool is part of Microsoft's Defending Democracy Program, through which it works with governments, nongovernment organizations, academics, and businesses to protect election campaigns, develop technology to protect processes, and defend against disinformation.

Microsoft isn't the only tech company strengthening its focus on election security. Late last summer, jurisdictions across the US registered for free website and user-account protection services offered by vendors including Google and Microsoft. Back in 2017, Google and sister company Jigsaw teamed up to offer digital protection – password alerts andmultifactor authentication – to election candidates and their campaigns.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13881
PUBLISHED: 2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13883
PUBLISHED: 2020-06-06
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.