Secure Electronic Registration and Voting Experiment
Secure Electronic Registration and Voting Experiment was an experiment by the Federal Voting Assistance Program to allow military personnel and overseas citizens covered by the Uniformed and Overseas Citizens Absentee Voting Act to vote in elections in the United States via the Internet. While called an experiment, SERVE included participation from 51 counties including up to 100,000 voters and ballots cast would have been counted toward actual election results. According to the SERVE security report, there were "two groups of eligible voters: American citizens living outside the U.S., and military personnel and their dependents, regardless of whether they reside in the U.S. or overseas." The project was contracted by FVAP to Accenture, who in turn subcontracted Avenade, Hart InterCivic, Hewlett-Packard, VeriSign, election.com, and others. The project was cancelled in 2004 after a report critical of the program was published. Accenture, who acquired election.com in 2003, has received criticism for its role in SERVE and other failed and cancelled electronic voting and registration projects.
Background
There are millions of Americans living overseas in at least 100 countries. In the early 2000's, Americans living abroad needed to take several steps to be able to vote in their home districts, often having to correspond via mail numerous times in order to obtain identity information and permission to be able to get a mail-in-ballot. This also presented a problem, because some of the countries that are housing Americans do not have the most reliable mail systems. With legal-binding deadlines to register and cast ballots, this time-consuming process may hinder many individuals from voting. According to the Security Analysis report, the Secure Electronic Registration and Voting Experiment was established to minimize time spent voting by creating an online platform, which would allow Americans overseas greater access to vote. This began as a small project of 84 voters in 2000, but was expected to be implemented in 50 countries with seven corresponding US state elections by 2004. This would have included around 100,000 ballots, in an attempt to one day develop a system with the capacity to include all overseas Americans.
Security report analysis
In order to assess SERVE's security, professionals from various backgrounds conducted an analysis. They analyzed and documented many weaknesses in SERVE. The report first discussed the likelihood that cyber-attacks would succeed against SERVE, as well as to what extent an event such as a hacker breakthrough could compromise an election. The report states that "the software of SERVE is totally closed and proprietary", an inadequate inspection of SERVE before its launch allowed it "to be vulnerable to various forms of programmer attacks". This is critical information in the voting world. According to the report, a potential hack into SERVE "could result in large-scale, selective voter disenfranchisement, and/or privacy violation, and/or vote buying and selling, and/or vote switching even to the extent of reversing the outcome of many elections at once". This means that if SERVE is implemented, elections as important as the Presidential could be completely fraudulent without any trace of a culprit. Finally, it was the critics' place to suggest any potential solutions that could remedy SERVE's vulnerabilities. Their report states, "that the vulnerabilities described cannot be fixed by design changes or bug fixes to SERVE," it explains that, "the vulnerabilities are fundamental in the architecture of the Internet and of the PC hardware and software that is ubiquitous today". It concludes that "there really is no good way to build such a voting system without a radical change in overall architecture of the Internet or some unforeseen security breakthrough".
Related experiments
As discussed by many experts, including a project manager at the Center for Public Integrity and a research fellow at Harvard's Kennedy School of Government, security was the largest threat to the SERVE program. These security risks were put to the test in 2010 when J. Alex Halderman, a professor of Computer Science at the University of Michigan, took on a challenge issued by the District of Columbia to see if Halderman's students could hack their new Internet Voting system. Halderman's Computer Science students were quickly successful. The students not only managed to disable the system but also were able to add votes, change votes, and manipulate the program so that once voters cast their ballots, the University of Michigan fight song would play. These hacking results were immediately turned over to the DC system team in order to strengthen the security wall of the program. Within days, the DC experiment was terminated as the security risks were deemed too high and the threats of fraud and corruption were undeniable. Subsequent studies have reinforced the enormous difficulty of the requirements for secure online voting, and defined the research and development needed in creating end-to-end auditable voting systems.
