Magazine menu Close Magazine menu

democracy

Latest stories

Person sits at a desktop computer ticking ballot boxes as if voting in an election, with a monitor shaped like a big padlock.

Is digital voting secure enough for national elections?

  • min read
    • With rising prices leading to political instability and voter turnout down around the globe, policymakers should also be asking how the can re-engage citizens in democracy. You've probably not seen that question answered quite so cluelessly as my local council in the run-up to its 2019 election, by sticking giant poo emojis all over town. Surprise – it didn't work. Voter turnout fell six percentage points on the previous election. Among the Facebook fury that called the poo emoji campaign tasteless and patronizing, a lone voice suggested another way to achieve the campaign's aim. "I filled in my voting papers a couple of weeks ago, but it's sitting in its envelope still, ready to be posted. When I get the chance to swing by a post box, I will, but it's not something I do these days. Bring voting into the click-of-a-button digital world, and you will have voters." Could it possibly be that simple? Voter turnout is falling in almost every country – a trend that started around 1990. When we've fought life-and-death battles to vote, could inconvenience really put people off something so important? It's certainly plausible –  behavioral science shows small changes in environment can make a big difference to what people choose to do. I asked democracy campaigners and commentators in several countries where they stand on digital voting. Do they think it will soon be feasible for national elections? Proportional representation may be fairer, but does it get us voting? Josiah Mortimer of the UK Electoral Reform Society dismisses digital voting entirely. "There are more pressing problems with the voting system than going to a polling station or getting a postal vote. Major privacy, accuracy and trust concerns have not been dealt with, and we feel the issue is a distraction from the real democratic crisis. The priority is ensuring every vote counts – in the UK by switching to proportional representation, modernizing voter registration and improving citizenship education." Proportional representation describes any electoral system that ensures the proportion of representatives elected matches their party's share of the overall vote. That's distinct from non-proportional systems like first-past-the-post or electoral college, where winning certain areas can see a party less popular overall gaining power. Proportional representation might make for fairer results, but could it reverse declining voter turnout? After New Zealand adopted proportional representation in 1993, voter turnout fell for many years, to an all-time low in 2011. Then, it started rising again, with their October 2020 election seeing the highest turnout in many years. Whatever drives New Zealand's election turn-out, there's more to it than proportional representation. For its "privacy, accuracy and trust" concerns around digital voting, Electoral Reform Society pointed me to a 2015 article, Why we can't vote online. It describes designing online systems that match the secrecy, accuracy and verifiability of paper as "incredibly hard," referencing flaws found in Estonia's election system in 2014. The article's arguments may have been fair and accurate at the time, but what about today? Five years is a long time in technology, and in the number of eligible voters who expect to do everything digitally. Ballot secrecy is the heart of the issue Lawrence Norden, Director for Election Reform and Democracy at the US's Brennan Center for Justice, often writes on security and electronic voting. He's optimistic online voting could one day be secure enough to rely upon, but cautions against 'too much, too soon'. "Election officials shouldn't be left on their own to figure out whether a system is secure and reliable. It is possible that one day, we can develop such a system. But currently, there are no generally accepted benchmarks to evaluate the security of online voting pilots." Norden places safeguarding electronic voting suppliers in his top two priorities. "We need a federal certification framework for election system vendors and their products. Hackers targeted vendors in 2016. We have little insight into vendors' internal cybersecurity practices, who works for them and who owns them. This is more of a security risk than we should be willing to accept." This makes sense, given supply chain attacks are common. Norden thinks ballot secrecy is the big challenge for voting online. "When we rely on software to provide us with election totals, as in the US, we must have a way to confirm the totals are accurate. The best way, while maintaining ballot secrecy, is to check the paper record against the electronic totals. There is no such record in paperless electronic machines or online ballots. If a hacker changes a vote transmitted over the internet, we might not know." Norden highlights voters can still do a lot to protect their vote from cyberattack. "They should check their voter registration online. They could volunteer to work on election day. They can learn the rules for how and when to vote early – the earlier people vote, the less chance a cyberattack can interfere with their ability to cast a ballot that will count." What does secure digital voting look like? Dr. Muhammad Rizwan Asghar, Senior Lecturer, School of Computer Science at the University of Auckland, is another frequent commentator on digital voting. Does he think online voting could be secure enough to be the election standard sooner, later or never? "One might argue if Estonia can do online voting, any country can, but this might not be true. There have been reported vulnerabilities on the voter and voting server ends. Even if we assume there are no issues with existing online voting systems, Estonia is a tech-oriented country with a population of just 1.3 million. "Addressing security risk for online voting means mitigating cybersecurity challenges at the user, communication and server levels. An online voting system needs a form of vote integrity, so votes can be tallied while ensuring voter privacy. Cryptographic schemes achieve this. Each voter encrypts her vote. Using a public bulletin board, voters can see the votes they cast. Once all the votes are cast, they're summed using homomorphic encryption, then the final sum decrypted. The decryption key is split among a set of trusted authorities who must collaborate to reveal the final result. It's promising, but not enough on its own. Some cybersecurity experts say there will never be anything safer than in-person voting with paper slips, but Dr. Asghar points out, "Each approach has its issues. In paper-based elections, people can be prevented from reaching polling booths. They can be harassed or coerced. A returning officer can spoil ballots. We can address most of these concerns using online voting. It could also make voting more accessible and help get results faster. But recent reports show voting servers are an attractive target for state-sponsored attackers. They can make servers unavailable using Denial of Service (DoS) or Distributed DoS (DDoS) attacks." What should any authority considering online voting learn from Estonia? "Estonia has made their system's source code public to foster trust and minimize the potential attack surface. They have internet and computer training programs for voters. If a voter has been coerced, they can go back later and change their vote or even vote in person on election day." Despite his optimism for the future of online voting, Dr. Asghar says it's hard to imagine online voting being ready for national-level elections in the next few years. "Not only is developing the system highly challenging, there must also be training in how to use it." How will we come to trust digital voting? British political philosopher Baroness Onora O'Neill speaks in her lecture series, A Question of Trust, of how public institutions should aim, rather than to be trusted, to be trustworthy. She argues it is being trustworthy that creates trust. The same may be true of electronic voting. For the public to trust it, it must prove itself trustworthy. Many of the risks of digital voting exist with paper-based voting and are as hard to detect in that setting. Secure, digital voting would offer voters protection paper cannot. The Brennan Center's Lawrence Norden makes sense when he says digital democracy shouldn't be rushed. But it seems high time to trial digital voting alongside existing options for lower-risk, local elections. In the face of plummeting voter engagement and global recession, the need to re-engage voters can't be put aside – trust in government depends on it. Policymakers must acknowledge technology has changed everything about how voters live. It must inevitably change how we vote.
blockchain disinformation

How one high-tech solution is helping fight fake news

  • min read
    • As ways to create and disseminate disinformation get more sophisticated and widely available, it's getting harder to tell fact and fiction. But the next version of the internet, Web3, might offer a 'force field' that could protect citizens from this troubling phenomenon. Start-ups and established media companies are using blockchain as part of solutions that aim to verify information and filter out false news. Is this what the world needs now, or could it open the door to even more disinformation? Fakes harder to tell from reality "There's huge money and huge power in fake news. We've seen it here in the US and around the world," says Jim Nasr, CEO of blockchain developer Acoer. Acoer created blockchain-based news platform NewsHash. Disinformation can have far-reaching and sometimes dangerous impacts. We saw this over the pandemic years especially, with rampant covid-related medical disinformation. Tommaso Canetta, vice director of Italian fact-checking agency Pagella Politica, says how false news spreads is "ever-changing. It can [come from] and go in every direction – from traditional to online media to politicians, or the other way around." A 2020 Reuters report found over 56 percent of internet users are worried if they can tell fake from real online. And 'deepfakes' – highly realistic looking audio, video and photos created using AI – further muddy the waters. A technological solution for filtering out fakes? Blockchain could create a 'built-in truth index' for the internet, effectively labeling and verifying each piece of information, creating a sort of watermark for authenticity. Used the right way, this could help people be sure news and media they receive are real. But it's complicated. Using blockchain in journalism might solve some problems but create others. For example, it may trigger more sophisticated disinformation, poor transparency or a single company like Meta (formerly Facebook) dominating the industry. What is blockchain? Blockchain stores information as blocks added in chronological order to a virtual 'chain,' stored securely and permanently. Once added to the chain, blocks are hard to change. Well-known blockchain platforms like Bitcoin and Ethereum use it to store financial transaction information, but the technology can also store and distribute news. Blockchain-based news platforms provide a secure and decentralized way to store verified information, which cannot be changed – like putting a digital watermark on verified news stories. Initiatives like the now-defunct Civil for journalism, Steemit for social media and Truepic for photo and video let publishers permanently link verified information to content in a blockchain. New York Times is also developing a blockchain-news platform, News Provenance Project. Fighting a powerful form of disinformation, miscaptioning – real photos or videos described in misleading ways – the project uses blockchain to permanently attach context (like who shot the film or image, when and where) to media. Acoer's NewsHash works by giving an article an encrypted hash (a unique string of characters) containing metadata added by the publisher, like the author's name and a publication identification number. "If the article changes in any way – even the most minuscule change – we can tell," says CEO Nasr. "And all in real-time." Readers can scan a QR code, which consults the blockchain to check whether an article or video is real. Nasr's company also assigns 'confidence scores,' rating information's authenticity. But while blockchain-based platforms can help protect against doctored images or false news pretending to be from a reputed source, they may also create new problems. But what's further up the chain? Technologies chasing a disinformation-free internet can backfire by encouraging more sophisticated disinformation or offering different versions of 'the truth.' Nasr says there are blind spots when publishing a completed news article on the blockchain because there are many places data can come from. The immutable nature of blockchain also means it may become harder to correct inadvertent errors in published material, making journalism as a whole seem like a less trustworthy source. Another issue is the potential for centralization – a single platform or business may start to dominate the news. "It's easy for an AI algorithm or company to become a centralized location for everything. It's like the internet – the idea is great, but we now have four companies [Meta, Amazon, Apple and Google] dominating it," says Nasr. "That's why we use a public ledger, instead of specific tools or proprietary algorithms, to [let readers] interrogate how we're getting there." The first and second lines of defense aren't technology With advances in AI, video and image editing software, tools for spreading disinformation will improve. Deepfake videos have already fooled internet users many times. "With the progress of fact-checking and technological tools to fight disinformation, we'll also see more complex disinformation," says Canetta. There's also a paradox in journalism requiring trust, while blockchain seeks to eliminate the need for trust. "Journalism is built around gatekeeping. You need someone to approve a story before it goes online – a hierarchy or system in place to ensure quality," says Walid Al-Saqaf, former journalist and senior lecturer in media technology and journalism at Södertörn University, Sweden. "But the notion of Bitcoin and the original blockchain was that you don't need trust." Canetta believes awareness and media literacy are the first and second lines of defense in fighting disinformation. He feels blockchain journalism isn't a silver bullet because "misinformation is not just an online phenomenon. We must teach school children that while they have access to unlimited information, not all of it is true or accurate." Using blockchain to secure other information Decentralized platforms like blockchain have many applications, like more secure communication between organizations, facilitating payroll and making auditing easier. Start-ups are working on blockchain systems that authenticate supply chains, enable digital voting, create and implement smart contracts and more. Within companies, blockchain can help secure data and make sure digital communications aren't altered. But it's not failsafe. For example, an unauthorized user can access a blockchain with a stolen password. And although it would require significant resources, it's possible to take over a whole blockchain and force a change. As blockchain evolves, so will ways to hack into it. Keeping systems updated and secure, and following security best practice will remain crucial to safer business.
river privacy predictions 2020

Never the same river: Predictions for privacy’s next decade

  • min read
    • Your phone. Your smartwatch. Your smart home. Your data is now everywhere. Collecting personal data makes services better for the user, but over the past decade, multiple cases have demonstrated the risk. In privacy, you never step in the same river twice. Concerns, threats and priorities are always changing. What privacy hazards will we see in the coming decade, and how should your business prepare? 1.  Governments will allow themselves to access more of citizens' data It's already happened, but in the next decade, governments around the world will adopt laws that let them access more of citizens' data. They may cite many reasons, including terrorism, instability and the already widespread use of the same data by business. 2.  The gap between regulation and the real world will only grow While the rationale for it is clear, enhanced access to people's data carries risks, such as unauthorized access and leaking information. It will be a big challenge for regulators to keep adapting regulations at the same speed as new technologies come into play. Companies have been slow to change how they're dealing with user data. The only recent significant change has been asking users to consent to how the company will use their data, now mandatory in many countries. We don't see any strong trend toward adding security to protect sensitive user data. There's already a growing gap between regulation and real-world practice, making regulation seem toothless. 3.  Counter-tools will fuel a privacy cyberbattle The trends I've already mentioned will encourage innovators to develop privacy protection technologies. The tech-savvy will adopt these, and more technologies will arise to circumvent them. It will be a privacy cyberbattle. Meanwhile, users will become more proactive about their privacy. There'll be high demand for password managers, virtual private networks (VPNs) and tokens (automatically generated codes) for two-factor authentication (2FA). However, protection mechanisms like 2FA tokens and password managers are just at the endpoint. Attacks and misuse are often at the backend. These tools protect the local environment, but they don't protect against attacks and abuse of systems such as the cloud. And as cloud-based tools go from being leading-edge to indispensable, all employees will need to understand where the risks are. VPNs protect against some data collection (real IP-addresses, geolocation) but don't protect against users voluntarily sharing data with services like Google and Facebook. 4. We'll keep getting fooled by fun Cybercriminals can use this strategy to attack businesses, targeting employees for personal information, and using it to access business systems and data. 5. We'll see new attacks on democratic process and  protections against disinformation These attacks have been with us for many years, and there's no reason for them to stop. Technology for fake visual and audio IDs already exist, and with the political pendulum of a US presidential election, these will bring undesired attention and abuse from multiple parties. 6. Internet of Things (IoT) vendors will scale up security investment The last few years have been turbulent for the cybersecurity industry. IoT-specific malware, data breaches and disinformation campaigns across the globe have all been challenging. This activity will push vendors to a new level of collaboration for the sake of security. Amazon, Apple, Google and the Zigbee Alliance have announced they're creating a working group to develop and promote a royalty-free connectivity standard. This will increase compatibility among IoT products and embed fundamental security. I hope others will follow their lead. All in all, we're looking at an interesting decade ahead for privacy. The challenges will be significant. Businesses will be a key player in securing the privacy of both their employees' and customers' data. Let's hope solutions from innovators follow fast on the heels of each new threat. In the meantime, by putting in place adequate, regular privacy training and cyberthreat education for all employees, any business can be part of the solution.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries