Diary of a Techie

I had the honor to attend a forum hosted by the PHilippine embassy in Singapore. The guest of honor were the top comelec officials like Chairman Abalos and Dir Tuason. In it, there were also Pinoy IT experts in the crowd. They were a bit dissappointed with the bad press that the comelec press release had on Pinoy IT professionals in Singapore.

Well on to the point, the comelec has deployed an internet voting system and was piloting it in Singapore. I wasnt able to look at it, so my comments here about its security are all based on what was revealed in the forum.

Mainly:

1. The engaged security professionals to do the standard penetration, hacking and capacity analysis tests. So sql injection, cross site scripting and the like were taken into account.

2. The have a process review by an IOWA university.

It seemed that the comelec had prepared for all contingencies. And then here comes this report that UC students in California were able to breach 4 voting systems in 45 days.

But to think of it from a macro point of view, if a hacker were engaged to manipulate the results of the voting, how would one do it? Where would one focus the attack?

I think the logical choice would be to attack the tabulation logic. One does not have to manipulate the details of each record. It would be elegant. One does not need to involve a lot of parties. This means less people know about it. Or the system could be rigged from the very start (not that this is in fact happening, I just put this in for discussions).

The obvious next question is…how does a nation ensure against this type of cheating/hacking/rigging?

One idea is to make the electronic equivalent of a NAMFREL. Where a parallel server or system would be setup that would get the same inputs as the comelec server/s. In theory, if rigging were done by a hacker on the tabulation routine, they would not have the same results!

In this sense, the PINOY IT professionals in Singapore that volunteered to do the ‘security validation’ could setup a parallel server to make sure that the end results of both systems are the same.

Filed under: Computing