Two newly revealed flaws in the Australian Capital Territory (ACT) electronic voting systems could have allowed voters to be linked to their votes, breaking the core democratic concept of the secret ballot. The vulnerabilities were disclosed in a detailed technical write-up on Monday by independent security researcher T Wilson-Brown, who originally discovered and confirmed the flaws in early January. Elections ACT had agreed in March to public disclosure on April 9, but on April 10 it pulled out. Four months later, Wilson-Brown has published them, to allow time for changes to be made before the next ACT election in 2020. The first vulnerability stems from Elections ACT publishing online the individual, and their preference allocations under the ACT’s preferential voting system, for later analysis.
Each record contains a unique sequential identifier, as well as a polling place batch number. A malicious voter could cast a deliberately unusual set of voting preferences, a pattern which would likely be unique, and use that as a marker to find the votes of people who voted around the same time in the same polling place.
This flaw existed during the 2001-2016 elections.
“The vote order data also makes it possible for anyone to discover the first and last votes in a polling place. It may also be possible to discover the first and last votes in each batch at each polling place, if batches rotate on a predictable schedule,” Wilson-Brown wrote.
Full Article: Flaws in ACT election systems could reveal voters’ votes | ZDNet.