Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/6/2019
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Debuts ElectionGuard to Secure Voting Processes

The new software development kit - free and open source - will be available to election officials and technology suppliers this summer.

Microsoft today debuted ElectionGuard, a free, open source software development kit (SDK) aiming to protect political voting processes as the spotlight on election security grows harsher.

CEO Satya Nadella announced ElectionGuard during his keynote at the Build developer conference, this week in Seattle. The SDK, built in partnership with security company Galois, is designed to make the election process more secure by providing verification throughout elections and letting third parties securely validate results, among other capabilities.

ElectionGuard isn't a voting machine, and it's not intended to replace paper ballots or support Internet voting. It's built to secure current systems that rely on modern voting technology and serve as a platform for new systems to protect against tampering. Microsoft's goal here is to give officials a means to handle and organize votes while letting individuals verify their votes. People can verify their votes were correctly recorded and that recorded votes were properly counted.

Verification happens in two ways: Each voter gets a tracker with a code that can be used to follow an encrypted version of his or her vote throughout the election. Voters also can see their selections on a Web portal provided by authorities; however, once a vote is cast, neither the tracker nor portal data can be used to reveal the vote. After the election, these codes can be used to confirm votes were not changed and were included in the total count.

The tool includes an open specification, or "road map," as Microsoft puts it, which lets voters and candidates run verifiers to confirm the recorded votes have been accurately counted. It relies on homomorphic encryption, which lets mathematical procedures be done to encrypted data. This lets individually encrypted votes be combined to form an encrypted vote count, which can be decrypted to view a full tally that protects voter privacy. Someone who runs an open election verifier can confirm encrypted votes were aggregated and the encrypted tabulation has been decrypted to get the final count.

[Hear Microsoft's Shawn Anderson, executive security adviser, present Crash Course: Principles of Endpoint Defense, at Interop 2019 next month]

"This process allows anyone to verify the correct counting of votes by inspecting the public election record, while keeping voting records secure," writes Tom Burt, corporate vice president of customer security and trust, in a blog post on the news. "The use of homomorphic encryption to enable verification is separate from and in addition to the process of paper ballots counted as an official election tally."

If a vote needs to be audited, ElectionGuard lets officials compare random ballot records with corresponding paper ballots to confirm a match. By comparing paper with digital records, fewer ballots would be necessary to ascertain confidence in an election, Burt explains.

ElectionGuard will be available this summer to election officials and technology suppliers so they can incorporate it into voting systems. Microsoft also has teamed up with election tech suppliers to explore integration of ElectionGuard into voting systems. It reports it has existing partnerships with suppliers responsible for more than half of the voting machines in the US.

This tool is part of Microsoft's Defending Democracy Program, through which it works with governments, nongovernment organizations, academics, and businesses to protect election campaigns, develop technology to protect processes, and defend against disinformation.

Microsoft isn't the only tech company strengthening its focus on election security. Late last summer, jurisdictions across the US registered for free website and user-account protection services offered by vendors including Google and Microsoft. Back in 2017, Google and sister company Jigsaw teamed up to offer digital protection – password alerts andmultifactor authentication – to election candidates and their campaigns.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
CVE-2016-4606
PUBLISHED: 2020-02-21
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...