Composing a conference program is difficult. You need to pick the right topics six to twelve months in advance and you hope they are current when the conference finally happens. Swiss Cyber Storm had a stroke of luck with settling on E-Voting as a focus theme for this year's conference. The Swiss Federal government had announced plans for a wide adoption of E-Voting in spring. By the time the conference approached, the discourse in the media got heated up. And several contradicting proposals were introduced into the parliament.
But let's first look at other noteworthy research presented at Swiss Cyber Storm. Over a dozen speakers covered various security topics going beyond mere technical problems. Professor Anthony Vance from the University of Hawai'i presented his research into Neurosecurity with the help of an fMRI scanner. He observed users while they used the computer and how they reacted to security-related interruptions. Users are notoriously bad at multitasking. But Professor Vance also tested several methods to improve the user's choices by varying the form and color of the pop-up messages. Furthermore, he showed the security questions in moments where users were not distracted. Professor Daniela Oliveira from the University of Florida examined users and their susceptibility to phishing attempts. Her research allowed her to identify key characteristics of successful social engineering campaigns. She includes authority, scarcity, commitment, liking, reciprocation, and social proof in this list.
The SCION internet architecture aims to solve many different security problems of the internet. It has been developed at ETH Zurich and was introduced to the audience by Dr Raphael Reischuk. The Border Gateway Protocol (BGP) has been the standard routing protocol of the internet for over 25 years. It does not give the sender any form of control over the course that an individual IP package takes. This can result in Swiss traffic travelling to Italy via two hops to China. This is highly inefficient. But it is also a big security problem when you would rather not have your sensitive data travel through the networks of your political enemy. SCION attempts to bring the control over traffic back to the sender. ETH has invested over 90 person-years into the creation of the protocol. It is now ready for deployment and SCION routers are popping up in more and more places.
The role of a security conference is not to decide if E-Voting is a good or a bad thing (A quick poll before the talks began showed a clear majority of E-Voting skeptics among the audience). Instead, the role of a conference is to provide useful information to the security minded audience. This allows everybody to form a qualified opinion of their own.
Professor Bryan Ford defined E-Voting in the Swiss context. In many countries, E-Voting means to enter your ballot on a touch screen device in the election office. These unregulated devices are notorious for their weak security. And the situation has not improved in many years. In Switzerland however, E-Voting means to cast your ballot from home with the help of a computer. It is then sent to a central server into an encrypted ballot box. This resembles the traditional voting by paper mail on an additional electronic channel.
Professor Ford continued to lay out the history and development of E-Voting in Switzerland. Swiss cantons conducted over 150 pilot elections. And the Swiss Federal Chancellery established itself as the key knowledge keeper that supervises the development. The Federal Chancellery defines the requirements for E-Voting systems that are then chosen by Swiss cantons. The requirements vary with the target percentage of voters allowed to use the electronic channel. The certifications allow 10%, 30%, 50%, or 100% of the voters to use the electronic channel.
Bryan Ford also explained the key problems of E-Voting. The need for voter anonymity is one of them. It conflicts with the full verifiability of the result. These two requirements are like two magnets that repeal each other. Fulfilling the requirements would be impossible without the help of advanced cryptographic protocols.
Jordi Puiggalí, head of research and development at the Spanish company SCYTL, followed Professor Ford. He presented the E-Voting solution his company has developed for Switzerland. It is the solution of a joint venture of SCYTL with Swiss Post. This offering has achieved the 50% certification level for Switzerland. The two companies reached this milestone thanks to a solution to the anonymity problem and a technique called individual verification. It allows a voter to check whether his ballot has been registered without being altered on the way into the encrypted ballot box.
The next speaker was Thomas Hofer from the State of Geneva. He presented CHVote, the 2nd E-Voting solution certified for public use in Switzerland. Geneva is the player with the biggest experience with E-Voting pilots. Based on this experience, it has joined with the Bern University of Applied Sciences. Together, they designed a completely new E-Voting system aiming for 100% certification. A crucial element of the requirements on this level is the introduction of four so-called independent control groups. This goes beyond the individual verification and supervises the entire voting process. This is an application of the Byzantine Generals Problem: The separate control groups guarantee a secure vote if at least one of the four is not corrupted by an attacker.
After this talk, the discussions intensified. But the room had to be closed, so the talks continued in the networking lounge of the conference with participants from Geneva and Swiss Post. This exchange was a success in itself, as the two teams are also competing in a fierce way on the market.
The organizers received excellent feedback. This validates their goal of bringing top international speakers in front of a very diverse Swiss audience. This audience includes young talented students, techies, Chief Security Officers and University researchers. The very personal introductions to the presentations gave the conference an almost familiar touch. This fostered exchange and a general mixing of the audience.
For 2018, the conference moves from Lucerne to Berne and aims to reproduce the success. Of course, the bar is now raised very high.
Dr Christian Folini on Twitter
