Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/6/2019
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Debuts ElectionGuard to Secure Voting Processes

The new software development kit - free and open source - will be available to election officials and technology suppliers this summer.

Microsoft today debuted ElectionGuard, a free, open source software development kit (SDK) aiming to protect political voting processes as the spotlight on election security grows harsher.

CEO Satya Nadella announced ElectionGuard during his keynote at the Build developer conference, this week in Seattle. The SDK, built in partnership with security company Galois, is designed to make the election process more secure by providing verification throughout elections and letting third parties securely validate results, among other capabilities.

ElectionGuard isn't a voting machine, and it's not intended to replace paper ballots or support Internet voting. It's built to secure current systems that rely on modern voting technology and serve as a platform for new systems to protect against tampering. Microsoft's goal here is to give officials a means to handle and organize votes while letting individuals verify their votes. People can verify their votes were correctly recorded and that recorded votes were properly counted.

Verification happens in two ways: Each voter gets a tracker with a code that can be used to follow an encrypted version of his or her vote throughout the election. Voters also can see their selections on a Web portal provided by authorities; however, once a vote is cast, neither the tracker nor portal data can be used to reveal the vote. After the election, these codes can be used to confirm votes were not changed and were included in the total count.

The tool includes an open specification, or "road map," as Microsoft puts it, which lets voters and candidates run verifiers to confirm the recorded votes have been accurately counted. It relies on homomorphic encryption, which lets mathematical procedures be done to encrypted data. This lets individually encrypted votes be combined to form an encrypted vote count, which can be decrypted to view a full tally that protects voter privacy. Someone who runs an open election verifier can confirm encrypted votes were aggregated and the encrypted tabulation has been decrypted to get the final count.

[Hear Microsoft's Shawn Anderson, executive security adviser, present Crash Course: Principles of Endpoint Defense, at Interop 2019 next month]

"This process allows anyone to verify the correct counting of votes by inspecting the public election record, while keeping voting records secure," writes Tom Burt, corporate vice president of customer security and trust, in a blog post on the news. "The use of homomorphic encryption to enable verification is separate from and in addition to the process of paper ballots counted as an official election tally."

If a vote needs to be audited, ElectionGuard lets officials compare random ballot records with corresponding paper ballots to confirm a match. By comparing paper with digital records, fewer ballots would be necessary to ascertain confidence in an election, Burt explains.

ElectionGuard will be available this summer to election officials and technology suppliers so they can incorporate it into voting systems. Microsoft also has teamed up with election tech suppliers to explore integration of ElectionGuard into voting systems. It reports it has existing partnerships with suppliers responsible for more than half of the voting machines in the US.

This tool is part of Microsoft's Defending Democracy Program, through which it works with governments, nongovernment organizations, academics, and businesses to protect election campaigns, develop technology to protect processes, and defend against disinformation.

Microsoft isn't the only tech company strengthening its focus on election security. Late last summer, jurisdictions across the US registered for free website and user-account protection services offered by vendors including Google and Microsoft. Back in 2017, Google and sister company Jigsaw teamed up to offer digital protection – password alerts andmultifactor authentication – to election candidates and their campaigns.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...