Hacking German Elections

After the first unsuccessful deployment of voting machines in Germany about ten years ago, elements of electronic voting have reached elections again. Although there is now still a paper-trail, more and more essential steps, such as counting the votes, are moved into electronic systems. This change in the ballot-counting procedure took place mostly unnoticed by the public. We are two very concerned election workers who present our first-hand experience in this talk. We show that the current digital procedure is conceptually and practically flawed in terms of security. First, we give an insight into the role of computers and their interaction with humans during ballot-counting. We show that the underlying system concepts contradict IT-security best-practices. Next, we present an in-depth analysis of one ballot-counting software, deployed for the Bavarian municipal elections ("Kommunalwahlen"). We discovered several severe security vulnerabilities that allow an almost unnoticeable manipulation of local voting results. Finally, we conclude that there is an immediate need for action to re-establish election security and transparency - not only for the government but for everyone of us.

Elections are a key element of every democracy. However, many democratic countries in the world have to face attacks on them, be it by the government or by foreign countries. Even if ballot counting has been finished, election results are often not accepted but questioned due to alleged manipulations. All these aspects pose major threats to democracy as they try to undermine the actual and publicly perceived integrity of elections.

In Germany, elections are usually considered quite secure. Elections are paper-based and the subsequent ballot-counting is open to the public. The infamous introduction of electronic voting machines about ten years ago was finally stopped by the German Federal Constitutional Court. Thus, everything is human-controlled, transparent, and secure – isn’t it?

Unfortunately, these claims are questionable since the silent introduction of electronic vote counting. The election system in Germany is quite complex, for example in the "Kreistagswahlen" (~district elections) workers have to count up to 70 individual votes per ballot, while respecting a special rule set. This process is very labor-intensive and sufficient election workers are often hard to come by. Due to this, electronic systems were introduced that provide support during vote counting. Election workers are no longer required to fill tally sheets, count votes, and sum them up on their own. Each ballot is simply entered into a software that performs all the magic and finally emits a result.

This year, we volunteered again as election workers, but our trust in electronically-assisted elections has been vastly impacted. As IT-security researchers, we consider it our responsibility to share and discuss our concerns. We performed a thorough analysis of the concept and the hard- and software of the electronic vote counting system. We discovered several flaws on a conceptual and practical level, that can severely diminish the integrity of the election and makes it prone to manipulations. To underline the impact of the system’s vulnerabilities, we demonstrate an exemplary attack on an election.

Finally, we propose different options on how to make elections secure again. We do not consider this an entirely technical case, as there are significant legal and societal circumstances that led to the deployment of this insecure system.