A Vulnerability Assessment of “Indelible” Voter’s Ink* · 2017. 10. 6. · Voter’s Ink...

JournalofPhysicalSecurity10(1),30-56(2017)

30

AVulnerabilityAssessmentof“Indelible”Voter’sInk*

RogerG.Johnston,Ph.D.,CPP

RightBrainSekurityhttp://rbsekurity.com

AbstractManycountriesusesupposedly“indelible”inktostainavoter’sfingertopreventmultiplevotesbythesameperson.Thisinkisusuallycomposedofsilvernitrate,andissometimesalsousedwhencountriesreplacetheircurrency.Inthisstudy,Ideviseanddemonstrate6differentlow-costmethodsforpreventingand/orremovingsilvernitratestains.Thoughnotfullyoptimized,allofthesemethodsworkedfairlywell,andcanprobablybeusedinpracticeforduplicatevotingmultipletimesperdaypervoter.Theattacksmightalsoworkforthelesscommonuv-fluorescentvoterinks.Iproposecountermeasuresfordetectingthesekindsofattacks,butitisquestionableiftheyareadequatetodetectvoterfraud.Thisworkisonlypreliminaryandhasseriouslimitations.IntroductionAtleast38countriescurrentlyuse(orhaveatleastrecentlyused)supposedlyindelibleinkduringelectionsinanattempttopreventfraudulentdoublevoting.[1]Beforeoraftercastingaballot,avoterhashisorherfingerstainedwithanink,whichisusuallybasedonsilvernitrate.Thestainedfingerisintendedtotagthevoterandpreventhim/herfromvotingmorethanonce.Electionofficialsmustcheckavoter’sfingersfortheabsenceofthesilvernitratestainbeforeallowingthemtovote.Voter’sinkhasalsobeenusedtolimitfraudincurrencyexchangeswhenacountryshiftsovertonewcurrency.[2-4]Insomecountries,thelittlefingerisstained[5,6];othersapplythestaintothepointer(index)fingerorthethumb[7-11].InKenya,womenwhoarewearingnailpolishcanhavetheinkappliedtothewebbetweentwofingers.[33]Thesilvernitratestaintypicallywearsoffskininabout4to7days.Itmaytakeseveralweeksforthestainonthefingernailorcuticletodisappear.[9]Thevoter’sinkisappliedinanumberofdifferentways,dependingonthecountryandelectionjurisdiction.[8,9,12,13]Somecountrieshavethevoterdiphis/herhandintheink.Inothers,theinkissprayedon,paintedonwithabrushorstick,orappliedwithafelttippen.Forthelatter,athicklineisoftendrawn[14-16]betweenthemiddle(orend)ofthefingernail,perpendiculartothecuticle,andontotheskin,asshowninfigure1.______________*Thispaperwasnotpeerreviewed.


31

Insomecountries,thevoter’sinkisappliedbeforethevotergetstheballot.[6,11,17-20]Thistendstoleavestainsontheballotorvotingmachineifthesilvernitrateonthevoter’sfingerhasnotfullydried.[17,18,21]Othercountriesorelectionjurisdictionsapplythevoter’ssilvernitratejustbeforethevoterexitsthepollingplace,possiblytoavoidthisproblem.[10,13,22]Electionofficialsandmanufacturersofthevoter’sinkfrequentlyclaimthatitisdifficultor“nearlyimpossible”or“impossible”toremovethesilvernitratestainfromafinger.[14-16,23-25]Inmyexperience,claimsthatanykindofsecuritycan’tbedefeatedareusually(oralways?)erroneous.[27,28]Moreover,simpleattacksoftenworkwell,evenagainsthigh-techsecurity[29](whichsilvernitratestainingisnot).Thispaperisanaccountofarudimentaryvulnerabilityassessmenttoidentifyandbrieflytestvariouswaystodefeatsilvernitratevoter’sink.Ithenproposepossiblecountermeasurestotheattacks.Thesearecountermeasuresthatelectionofficialscouldpotentiallyusetoreducefraudulentvoting.Anotheruseforthisinformationisthathonestvotersmaywanttoremovesilvernitratestainsaftervoting,includingfortheirownsecurity.Terroristshavereportedlyattackedpeoplewithstainedfingers,anddomineeringhusbandshaveattackedtheirwives,inanattempttodiscouragevoting.[9,30-32,34]Voter’sInkChemistryMostorallofthesupposedly“indelible”voter’sinkismadebydissolvingsilvernitrate,AgNO3,inwater.Thesolutioniscrystalclearwhenthesilvernitrateispure.Whenappliedtotheskinorfingernail,thesilvernitrateinthesolutionreactswithsalt(sodiumchloride)onthefingertoformsilverchloride(AgCl)andsodiumnitrate(NaNO3)asfollows: AgNO3+NaClAgCl+NaNO3 {1}Whenexposedtolight,primarilyultraviolet(uv)lightbuttoalesserextent,bluelight,thesilverchloridedecomposesintosilvermetalandchlorine(whichdiffusesaway).Seereaction{2}. AgCl+uvlightAg+Cl {2}Bothsilvernitrateandsodiumnitratearehighlysolubleinwater.AgClisonlyslightlysoluble,however,andsilver(Ag)isnotsolubleinwaterormostsolvents.Thesilverinreaction{2}thatbuildsupduetothebreakdownofAgClbecomesastainthattakesonvariouscolorsasitdarkens,primarilygrey,purple,andbrown,beforeeventuallybecomingdarkblackwithperhapsahintofhematitered.Addingtotheblackcolormaybethetarnishingofthesilverasitslowlyreactswithwater,sulfur,andvariousorganiccompoundsonthefinger.Thesilvernitratestaincandarkeninminutesunderdirectsunlight,butmaytakeanhourormoreatlowtomoderatelightlevels.


32

Figure1showsmythumbafteritwasstainedwitha15%(w/v)puresolutionofsilvernitrate,andalsobythesamesolutionwithagreenfoodcolordyeadded(“dopedin”).Thetwolinesonthethumbareparallel.BothsilvernitratesolutionswereappliedwithaQ-tipstartingontheskin,andmovinguptothethumbnail,travelingperpendiculartothecuticle.Thismimicsthewaythatmanycountriesapplythesilvernitratesolutionwithabrushorfelttippen.Thethumbisshownafter2hoursofindoorillumination(middle)andafteranadditional6.5hoursofsunlight(right).

Figure1-Silvernitratestains.Left:acolorless15%silvernitratesolutionwasappliedtothethumb(difficulttoseeinthephoto),alongwithacoloredversionparalleltothefirstline.Stainsareshownat2hours(middlephoto)afterilluminationfromindoorlighting,andafter6.5hoursofadditionalilluminationfromsunlight(atright).Mostvoter’sinks[2,9,16],haveasilvernitrateconcentrationofbetween10%and20%(w/v),thoughoccasionallya5%concentrationisused[2,8].Thegreatertheconcentration,thefasterthestaindarkens,thedarkeritultimatelybecomes,andthelongeritlasts.Thereislittlepoint,however,tousingaconcentrationgreaterthan18%sincehigherconcentrationsdonotincreasethespeedofappearance,thedarknessofthestain,oritslongevity.[9,16]Moreover,thehigherconcentrations(especially>25%)alsointroducemorehealthrisksforvotersandelectionofficials.Silvernitrateisaskinandeyeirritant,toxicinlargequantities,andcanoccasionallycausesignificantinjury.[9,16,23,35,42]Itturnsouttobedifficulttoobtainactualvoter’sinkinsmallquantitiesintheUnitedStates.Thisispresumablyduetolackofdemand.Instead,Iuseda15%(w/v)puresolutionofsilvernitrate.ThiswasmanufacturedbyAZLaboratories.Voter’sinkformulationsoftenincludeawater-solublecoloreddyesothatthesolutioncanbeinitiallymoreeasilyseen,especiallyatfirstapplication.[2,9,11,14,22]Seefigure1.Withoutthisdye,itisdifficulttodetermineiforwheretheclearsilvernitratesolutionhasbeenapplieduntilthestainbeginstodarkenviareactions{1}and{2},whichcantakeminutestohours,dependingontheamountofsodiumchlorideonthefingerandtheilluminationlevel.Voter’sinksalsooftenhaveabiocidetoretardthegrowthofmicroorganisms.[2]Ethanolissometimesaddedtospeedupthedryingprocesswhenthe


33

inkisappliedtoafinger.[2,21]Thoughrare,somevoter’sinksinclude(orconsistentirelyof)uv-fluorescentdyes,whichrequireanultraviolet(uv)lighttodetect.[55]PreviouslyProposedAttacksVariousattacksonthevoter’sinkhavebeenpreviouslyproposedordemonstratedbyothers.[11,14,16,24,25,36-40]Manyinvolvehouseholdchemicals.Noneofthesemethodsseemlikelytobeeffectiveorpracticalexceptpossiblythereportedmethodofremovingthestainusingamatchandconsiderablerubbing.[14]Thesulfiteinthematchheadpresumablyhelpswiththestainremoval.Thisattack(whichIdidnottest)reportedlytakesabout7minutes[14]andmightbeimpracticalwhenthestainisappliedtoalargeareaofthefingerratherthanjustbeingastainlineasinfigure1.Remarkably,noneofthesepreviouslyproposedattacksare“backdoor”attacks,exceptforthecandlewaxattackdiscussedinreference[41].Alltheothermethodsinvolvetryingtodealwiththesilvernitratestainonlyafteritforms.Inthiscontext,abackdoorattackinvolvesthevotecheatertreatinghisfingerbeforestaininginawaythatpreventsthestainfromformingorfullyforminginthefirstplace,orinawaythatatleastmakesitmucheasiertoremovethestainafterthesilvernitrateisapplied.(Moregenerally,abackdoorattackonsecurityinvolvestamperingwiththesecuritydesignorinsertingalienfeaturesinawaythatpermitsthesecuritytobedefeatedeasilyatalatertime.)Thebackdoorattackdiscussedinreference[41]involvedputtingcandlewaxonthefingertoblockthesilvernitrate.Thewax,however,wouldnotbeverywettable,isprobablynotverytransparent,andwouldlikelybeeasilyspottedbyelectionofficialsbasedonitsappearanceorbehavior.NewAttacksIdevisedandtested6newattackstodefeatvoter’sinks.Theyareasfollows:Attack#1-KeeptheFingerintheDarkThesilvernitratestainreliesuponthepresenceofNaClonthefingerandonlight.Thesimplestattackistoreducetheamountofboth.Theprotocolforthisattackisasfollows:

1.WashbothhandsandtherelevantfingerthoroughlywithhotwaterandsoaptodissolveawaytheNaCl.(Inahotclimate,itmaybedifficulttokeephandsfromperspiringsothewashingshouldoccurasclosetothetimeofenteringthepollingplaceaspossible.)2.Oncethesilvernitrateinkisappliedatthepollingplace,dowhateveryoucantoshieldthefingerfromlight,aslongasthisdoesnotattractundueattention.Thiscanmosteasilybedonebymakingafistand/orpointingthestainedportionofthefingertowardsthefloororyourbodywherethefingerislikelytoreceivelessillumination.Alternately,stickingthefingerinapurse,smallcardboardtube,oracoffeecupmight


34

substantiallyreducetheilluminationreachingthesilvernitratewithoutattractingnoticebyelectionofficials.3.Afterleavingthepollingplace,keepthefingerinthedarktotheextentpractical.Assoonaspossible,washthefingerunderlow-lightconditionswithsoapandrunninghotwaterfor20seconds(usinganailbrush)towashoffthesilvernitrate.(Thesilvernitrateinvoter’sinkisverysolubleinwaterevenafterthesolutiondries.)4.Quicklydrythefingerandputitintotaldarknessbycoveringitwithanopaqueglove.Alowercostapproachistomakeanaluminumfoilcotwhichiscrimpedonthefinger,asshowninfigure2.Alittlemaskingtapecanhelpkeepthecotinplaceifnecessary.5.Removethecotjustbefore(illegally)votingthenexttime.Ifthereisanyslightstainingonthenailorskin,removeitwithaflexible,foamemeryboardnailfile(muchmoreeffectiveandmaneuverablethanarigid,metalnailfile).Alternately,itisquickerandeasiertousearelativelyinexpensiveelectronic“nailfilingsystem”,suchasshowninfigure3.Thisisbasicallyahorizontalmillwithaspinningcarbidewheelthatcanabradeafingernail,cuticle,ornailpolish(orskin).Inthispaper,Iwillcallsuchdevices“nailgrinders”—inelegantterminologybutessentiallyaccurate.Thesenailgrindersareusedbyprofessionalnailtechniciansinmanynailsalons(thoughtheydon’tcallthem“nailgrinders”),andbyconsumersathome.Afingernailortheskincanonlybedeeplyabradedapproximately2-3timesbyanailgrinderbeforeitbecomestoodamaged.[42]6.Repeatthesestepsforadditionalfraudulentduplicatevotesbythesameperson.

Figure2-Acrimpedaluminumfoilcottoprotectthestainedfingerfromexposuretolight.Inthisphoto,itisonthepointer(index)fingeroftherighthand.

Figure3-TheKupaManiproelectricnailfilingsystem(“nailgrinder”)usedinthisworkfordemonstrations.


35

Attack#2-EggWhiteProtectiveCoat

1.WashbothhandsandtherelevantfingerthoroughlywithhotwaterandsoaptodissolveawaytheNaCl.(Inahotclimate,itmaybedifficulttokeephandsfromperspiring,sothewashingshouldoccurascloselytothetimeofenteringthepollingplaceaspossible.)Drythefinger.2.Dipthefingerineggwhitefromarawchickenegguntilitiswellcoated.Removeanyairbubblesandre-dip.Allowtodry.(Thiscantakeafewminutes.)Thedriedeggwhite,whichisnotverywatersoluble,isintendedtobeabarrierthatshieldsthefingerfromthesilvernitrate.3.AswithAttack#1,oncethesilvernitrateisappliedatthepollingplace,dowhateveryoucantoshieldthefingerfromlight,aslongasthisdoesnotattractundueattention.4.Afterleavingthepollingplace,keepthefingerasdarkaspractical.Assoonaspossible,washthefingerunderlow-lightconditionswithsoapandrunninghotwaterfor20secondstowashoffthesilvernitrate.Useanailbrush.5.Toremovetheeggwhite,dipthefingerinraweggwhiteandwipeofftheoriginaleggwhitecoatingwithatissue.Liquideggwhiteisthebestwaytoremovedriedeggwhite.Dothisunderlow-lightconditions.6.Washthefingerinhotwaterandsoapunderlow-lightconditions.7.Drythefingerandputitintotaldarknessbycoveringitwithanopaquegloveoranaluminumfoilcot.8.Removethegloveorcotjustbefore(illegally)votingthenexttime.Ifthereisanyslightstainingonthenailorskin,removeitwithafoamemeryboardnailfile,oranelectricnailgrinder.9.Repeatthesestepsforadditionalfraudulentvotesbythesameperson.

Attack#3-KIProtectiveCoat

1.WashbothhandsandtherelevantfingerthoroughlywithhotwaterandsoaptodissolveawaytheNaCl.2.Drythefinger.3.Brushona1%solutionofKIinwater.Allowtothoroughlydry.SinceKIreactswith(anddissolves)silvernitrate,itcanpotentiallyhelptokeepthesilvernitratefrompenetratingtheskinorfingernail.


36

4.Oncethesilvernitrateinkisappliedatthepollingplace,dowhateveryoucantoshieldthefingerfromlight,aslongasthisdoesnotattractundueattention.5.Uponleavingthepollingplaceaftervoting,putthefingerintotaldarknessusinganopaqueglove,fingercot,orsomeothermethod.6.Assoonaspossible,rinsethefingerina16%solutionofKI(w/v)underlow-lightconditions.BrushthefingervigorouslywithatoothbrushwettedwiththeKIsolutionfor20seconds.Flextheknucklesasyoudothistoincreasepenetration.7.Stillunderlowlightconditions,repeatstep6exceptusea16%solution(w/v)ofKBrandadifferenttoothbrush.8.Washthefingerwithhotwaterandsoapunderlow-lightconditions,thendrythefinger.9.Placethefingerincompletedarknessusinganopaquegloveorasinglefingercotmadeofaluminumfoilorsomeothermethod.10.Removethegloveorcotjustbefore(illegally)votingthenexttime.Ifthereisanyslightstainingonthenailorskin,removeitwithafoamemeryboardnailfile,orwithanelectricnailgrinder.11.Repeatthesestepsforadditionalfraudulentvotesbythesameperson.

ThereasoningbehindtheKIandKBrrinsesinAttack#3isasfollows:Thewaterinthe16%KI-watersolutiondissolvesmuchofthesilvernitrateoffthefinger,becausesilvernitrateishighlysolubleinwater.TheKIinthe16%KI-watersolutiondissolvesoffmuchoftheremainingsilvernitratebyreactingwithitasshowninreaction{3}. AgNO3+KIAgI+KNO3 {3}“KIaqueousrinse”TheAgIthatresultsfromreaction{3}islesslightsensitivethantheAgClin{1},sowillgeneratelessstaining.(TheorderofsilverhalidelightsensitivitygoesAgBr>AgCl>AgI[43].)SomeoftheAgClthatformedviareaction{1}beforetheKIrinsewillbedissolvedbythewaterintheKIsolution,thoughnotmuchbecauseAgClisnotverysoluble.Seetable1.(Thesodiumnitrateandpotassiumnitrateproductsformedinreactions{1}and{3},incontrast,arehighlysolubleinwater.)Nowwecouldpotentiallystopafterreaction{3},havingdissolvedandconsumedmostofthesilvernitrate,andhavingformedtheleastlightsensitivesilverhalide(AgI).Theproblem,however,isthatsomeofthesilvernitratewillhavebeenconvertedtoAgClvia{1}inthetimedelaybetweenstainingthefingeranddoingtheKIrinse.SowiththeKBrrinse,wedissolveoutthisAgClusingthewaterintheKBrsolution(AgClisslightlywatersoluble),butmoreimportantly(seereaction{4})wedissolvetheAgClonthefingerby


37

havingitreactwiththeKBrinthesolution.ThedownsidetothisKBrrinseisthatitleavesuswiththemostlightsensitiveofthesilverhalides,AgBr,asaproduct.Fortunately,however,AgBrisatleastalittlesolubleinwater,plustherewillbeverylittleofitleftatthispointanyway. AgCl+KBrAgBr+KCl {4} “KBraqueousrinse”TheAgIformedinreaction{3}isdissolvedoffthefingerpartiallywiththeKBrsolution,butsomeofitformsAgBrintheKBrrinseviareaction{5}below.Again,thisisnotdesirablebecauseAgBristhemostlightsensitiveofthethreesilverhalides;fortunately,theamountofAgBrpresentatthatpointshouldbequitelow. Agl+KBrAgBr+Kl {5} “undesirablesidereaction”AnyslightstainthatmightappearovertimeaftertheKIandKBrrinsesisprobablyduetowhateversilverhalidesareleftonthefingeraftertherinses,andwhateverinaccessiblesilvernitratewasleftonthefinger.RinsingwithhotwaterbeforetheKIrinseinAttack#3,andalsobetweentheKIandKBrrinsesmightmakesensetotrytoreducethesilverhalideproductsandtraceamountsofsilvernitratefurther,butthiswasn’ttested.

Table1–Thesolubilityof3silverhalidesinwaterat25°C.[44]

silverhalide solubility(mg/liter)AgCl 1.93AgI 0.026AgBr 0.135

Attack#4a-EggWhiteProtectiveCoatwithKI&KBrRinsesThisattackisidenticaltoAttack#2exceptthatwerinsewith16%KIandKBrsolutionsasisdoneforAttack#3.Attack#4b-1%KICoat+EggWhiteProtectiveCoatwithKI&KBrRinsesThisattackisidenticaltoAttack#4aexceptthatweapplya1%KIsolution(w/v)tothefingerpriortotheeggwhitecoat.Thefingerisallowedtodrythoroughlybeforedippingthefingerineggwhite.Attack#5-MatteFingernailProtectiveTopcoatwithKI&KBrRinses


38

1.WashbothhandsandtherelevantfingerthoroughlywithhotwaterandsoaptodissolveawaytheNaCl.2.Drythefinger.3.BrushonRevlon790MatteTopCoatonthefinger—includingonthefingernail,cuticle,andskin.(Amattecoatislessglossythanregularfingernailpolishortopcoat,andsolessdetectable.Itisalsobetterwettedbyanaqueoussolutionofsilvernitrate.)Allowtothoroughlydry.Thismaytakeseveralminutes.Thepurposeofthetopcoatistoserveasaphysicalbarriertokeepthesilvernitratefromreachingthefinger.4.Oncethesilvernitrateinkisappliedatthepollingplace,dowhateveryoucantoshieldthefingerfromlight,aslongasthisdoesnotattractundueattention.5.Uponleavingthepollingplaceaftervoting,putthefingerintotaldarknessusinganopaqueglove,fingercot,orsomeothermethod.6.Assoonaspossible,rinsethefingerina16%solution(w/v)ofKIunderlow-lightconditions.BrushthefingervigorouslywithatoothbrushwettedwiththeKIsolutionfor20seconds.Flextheknucklesasyoudothisformaximumpenetration.7.Stillunderlowlightconditions,repeatstep6exceptusea16%solution(w/v)ofKBrandadifferenttoothbrush.Flextheknucklesasyoudothisformaximumpenetration.8.Stillunderlow-lightconditions,rinsethefingerinanacetone-basedconsumernailpolishremover.Brushvigorouslywithatoothbrushwettedwithacetonefor20seconds.Wipewithanacetone-soakedtissue.ThisremovestheRevlontopcoat.9.Washthefingerwithhotwaterandsoapunderlow-lightconditions,thendrythefinger.10.Placethefingerincompletedarknessusinganopaquegloveorasinglefingercotmadeofaluminumfoilorsomeothermethod.11.Removethegloveorcotjustbefore(illegally)votingthenexttime.Ifthereisanyslightstainingonthenailorskin,removeitwithaflexibleemeryboardnailfileorwithanelectricnailgrinder.12.Repeatthesestepsforadditionalfraudulentvotesbythesameperson.


39

AppearanceandWettabilityWhileitisuncertainifelectionofficialswouldevennotice,aprotectivecoatingmadefromastandard(glossy)nailpolishlookssuspiciouslyshiny,andasilvernitratesolutiondoesnotwetitwell.Seethemiddlefingerinfigure4.IfoundthatRevlon790fingernailmattetopcoat(apopularbeautyproduct)lookslesssuspiciousandwetsfairlywell.Thewettabilityoftheeggwhitecoatingfallsinbetweenamatteandaglossypolishortopcoat.Ihavedemonstratedthatwettabilitycanbeincreasedforeithertheeggwhiteorthemattetopcoatbyslightlyroughingupthesurfaceoftheprotectivecoatingwithanemeryboard(toincreasethesurfacearea),andthenwipingitwithanalcohol(isopropanol)padand/oradilutedetergentsolutionshortlybeforestaining.Theoretically,iftheeggwhiteortopcoatarelightlysteamed,theyalsoshouldbecomemorewettable,thoughIdidnottestthis.Figure4-Threefingersofmyrighthandareshownwithprotectivecoatingsappliedabovethetopknuckles,i.e.,onbothskinandfingernail.Thephotoontheleftshowsthecoatingsaftertheyhavedried.Inthephotoontheright,thesimulatedvoter’sinkhasbeenappliedacrossthecuticle,butthe(greendoped)silvernitratehasnotyetformedadarkenedstain.Thepointerfinger(leftmostineitherphoto)hasaneggwhitecoatingwithaslightlyglossyappearanceandwetsmoderatelywell.Themiddlefingeriscoatedwithastandardglossynailpolishandappearsquiteshinyifinspectedcarefully.Glossynailpolishesdonotwetwell,whichmightalsolooksuspiciousatthepollingplace(ifanybodyiswatching).TheringfingerhasacoatingmadefromtheRevlon790fingernailmattetopcoat;itdoesnotappearsuspiciouslyglossyanditwetsthebestofthe3coatings.SafetyIssuesTheKIandKBrsolutionsusedforsomeoftheaboveproposedattacksarearguablylesshazardousthansilvernitrateitself,whichdoesnotappeartobeaparticularlysafechemicaltobeapplyingtotheskinofmillionsofvoters[35,45-47],thoughitissometimesusedformedicalpurposes[23].Acetonealsoisrelativelyharmlessintheselowquantities,


40

thoughthereisaflammabilityrisk[48].Acetone,however,iswidelyusedinthehomeandinnailsalonsasafingernailpolishremoverwithapparentlyfewproblems.NotethateitherNaIorLiIcouldbeusedinplaceofKI,andNaBrorNaIcouldbeusedinplaceofKBrfortherinses,butthesecompoundsareslightlymoretoxicwheningestedinsignificantquantitiesthanKIandKBr.ResultsFigure5showsthetypicalresultsforAttack#1.A15%(w/v)silvernitratesolutionwithgreenfoodcolordyewasappliedtomymiddlefingeralongalineperpendiculartothecuticle,asinfigures1and4.Immediatelyafterstaining,thefingerwassemi-protectedfromilluminationfor10minutesbyformingafist.This10-minuteperiodismeanttosimulatethetimebetweenapplyingthesilvernitrateinkandexitingthepollingplace.(Longertimesdidn’tchangetheresultsmuch.)Theroomilluminationduringthis10-minuteperiodwas350lux—fairlytypicalofatleastindoorU.S.pollingplaces—andwasamixofnaturallight,fluorescentlights,andLEDlightbulbs.Afterthe10minutes,thefingerwasrinsedindistilledwaterunderlow-lightconditions.Itwasthenkeptinthedarkusinganaluminumcot,asinfigure2.Themiddlephotoinfigure5showsthefinger7.8hoursafterapplyingsilvernitrate.Somelightgreensalt(NaCl/KI)andasmallamountofsilvernitratestaincanbeseen.Ibuffedthisoffin30secondsusingafoamnailemeryboard.Theresultinshowninthephotoontheright.Anotherpersoncouldhavedonethistouchupfaster,asitisawkwardtoworkonone’sownnails.Aprofessionalnailtechniciancouldhavedoneitinafewseconds,withlessnailscratching,aswasdemonstratedtomebyaprofessionalnailtechnician.[42]

Figure5-Attack#1.Thewashedbutuncoatedfingerisstainedwitha15%silvernitratedopedwithagreendye(left)asitmightbeatthepollingplace.Afterbeingkeptinthedarkfor7.8hours,thefingerappearedasinthemiddlephoto.Somelightbuffingremovedtheminorstaining(rightphoto).


41

Itisdoubtfulthatthenailscratchesseenontherightmostphotooffigure5wouldmakeanelectionofficialsuspicious.Laborersandcraftspeopleoftenhavebangedupfingernails.Inanyevent,thescratchestendtohealthemselvesfairlyquicklyasskinoilfillsthem.ProfessionalnailtechniciansoftenuseJojobaoiltoaccomplishthesamethingimmediately.Figure6showswhathappenedtothefingerinfigure5afterbeingexposedtosunlightfor5hoursmore.Aslightsilvernitratestainappeared.ThissometimeshappensforAttack#1,butwouldnothavehappenedifthefingerhadbeenreturnedtothedarkaftertakingtherightmostphotographinfigure5ratherthanexposingthefingertosunlight.Thestainontheleftmostphotoinfigure6waseasilybuffedoffinunder30seconds,withtheresultshownontheright.Theselateappearing,light“ghoststains”aremucheasiertoremovethanthedeeperanddarkerstainsthatformonvoter’shandsifnoattacksareattempted.TheCheer#3[49]solution,discussedbelow,canalsobeofhelpinremovingtheghoststainsfromskin,butshouldnotbeneededunlessthevoterallowedthefingertoreceivetoomuchlight.

Figure6-Anyghoststainthatappearslater(left)duetosunlightexposurecanbeeasilybuffedoff(right).

Attack#2isslightlymoreeffectivethanAttack#1inthatitleaveslessofaghoststainorelsenoneatall.Theeggwhite(albumen)coatingappliedbeforethestainingreducestheamountofsilvernitratethatreachestheskinorfingernail. Figure7showsthesuccessfulresultsofAttack#3,wherethereareKIandKBrrinsestoremovethesilvernitrateandsilverhalides.Thethumbwaskeptinthedarkaftertherinses,asispartoftheAttack#3protocol.Attacks#4aand#4bwereevenmoreeffectivethanAttacks#1,#2,and#3,oftenleavingvirtuallynostainatallevenmanyhourslater.TheKIandKBrrinsesapparentlyeffectivelyremovedthesilvernitratesandsilverhalides.


42

Figure7-ThisshowstypicalresultsforAttack#3.Thetopleftphotowastakenimmediatelyafterthegreen-dyed15%silvernitratesolutionwasappliedtomythumbusingaQ-tip.After6hoursinthedark,thethumbappearedasshownintheupperrightphoto.Thelightgreensaltstainwasquicklyandeasilybuffedoff.Thethumbwasthenreturnedtothedark.Lowerleft:at23hoursafterthesilvernitratewasapplied,somestainingshows,butthiswasbuffedoffbymein30secondswithanemeryboard,resultinginthephotoonthelowerright.Someofthelightstainingshowninthelowerleftphotomayhavebeenduetothebriefilluminationusedtotakeseveralphotographsofthethumbaspartofatimeseries.Thisilluminationdonetodocumenttheexperimentwouldnothaveoccurredinpractice.Figure8showstypicalresultsforAttack#5.Thiswasthemosteffectiveattack.Theleftmostphotoinfigure8showsthefingerimmediatelyafterstainingwitha15%silvernitratesolutiondopedwithagreendye.ThemiddlephotoshowsthefingerimmediatelyaftertheKI/KBrrinses.Therewasnostainat17hours(notshown)withthefingerkeptinthedarkusinganaluminumfoilcot.Thephotoontherightinfigure8showsthefingerafterthecotwasremoved17hoursafter“voting”,andthefingerwasexposedtosunlightforanadditional5hours.Theveryslightsilvernitratestainbarelyvisibleinthemiddlephotowasremovedquicklywitha


43

foamemeryboard,butitisdoubtfulthiswouldbenecessarytofoolanelectionofficial.Figure8-Attack#5usingaRevlonmattetopcoat.Thenearlyinvisiblesilvernitratestainseeninthemiddlephotothatformedafter23hours(with5hoursofthatinsunlight)waseasilyremovedwithanemeryboardinsecondstoproducetherightphoto,eventhoughthiswouldprobablynotbenecessaryinrealvotingfraud.Ifafingerwasdippedfullyintothesilvernitratesolutionupto2cmdeep(insteadofstaininginalineasinfigure8),attack#5producedthesameresults:therewasnoevidenceofstainingafter12+hours,aslongasthefingerwaskeptinthedark.Ifthefingerwassubsequentlyexposedtoillumination,onlyaverylightghoststaincouldbeseen,andthiswaseasytobuffout,thoughittookmoretimebecausealargerareawasinvolved.Table2showstheestimatedturnaroundtimeforeachattack,i.e.,howmanyminutesareneededtoprepareavoterforthenextillegalvote.Theassumptionisthatallmaterialsandequipmentareinplacetostart.Turnaroundtimesmightbelongerinhigh-humidityclimatesbecauseasignificantamountofthetimeneededfortheattacksinvolvesthoroughdryingofthefinger.Aheatsourceordehumidifier,however,couldprobablybeusedtospeedupevaporation.Table2-Theestimatedtimeavoterneedstobereadyforanotherillegalduplicatevote,andtheapproximatenumberofvotespossiblepervoterina12-hourperiod.Thesetimesignoretransportationtimetoandfromthepollingplace,orlongdelaysinthevotingprocess.

Attack#estimatedturnaroundtime(mins)

approximatenumberofvotespervoterin

12hours1-KeeptheFingerintheDark 7 1002-EggWhiteProtectiveCoat 28 25

3-KIProtectiveCoat 25 254a-EggWhiteProtectiveCoatwithKI&KBrRinses 35 20

4b-1%KICoat,EggWhiteProtectiveCoat,KI&KBrRinses 40 185-MatteFingernailProtectiveTopcoatwithKI&KBrRinses 40 18


44

Theslowestattackwouldallowavotertocastabout18votesper12-hourperiod.Duplicatevotes,however,maybelimitediftheskinorfingernailshavetobesubstantiallygrounddownmorethan2timesusingtheflexibleemeryboardsortheelectricnailgrinder.Turnaroundtimeswouldprobablybeshorter—andthecleanupoflightstainsquickerandbetter—ifaprofessionalnailtechnicianweredeployedfortheattack.WhileIcouldnotfindanystatisticsontheprevalenceofprofessionalnailtechniciansinvariouscountries,itappearsthatmostorallofthecountriesthatusevoter’sinkhavealargenumberofnailsalons.Evenifnailtechnicianswerehired,however,theyareusuallyrelativelylow-wageworkers(despitetheirartistry).Thus,itisreasonabletoassumethatvotercheaterscouldhaveaccesstonailtechnicianstohelpwiththevotingfraud,thoughitisnotmandatory.AttackCostsThecostoftheseattacksismodest.Forexample,thecostoftheRevlonmattetopcoatislessthan7¢perfingeratretailprices.Allofthematerials,supplies,andequipmentarereadilyavailable,evenindevelopingcountries.BasedonthecostsofitemsIprocuredtostudyanddemonstratetheseattacks,theestimatedmarginalcost[50]forthemostexpensiveattack(#5)is54¢pervoteatretailprices.Fortheleastexpensiveattack(#1),themargincostisonly4¢(retail).Atwholesaleprices,thesemarginalcostswouldbeapproximately20¢and2¢,respectively.Themarginalcostsarebasedonthecostofconsumablematerialsandsupplies.Therearealsoexpensesfornon-consumableequipment.TheretailcostoftheitemsIneededtoexecutetheattacks—whichwouldbesufficientforatleastseveralthousandfraudulentvotes—was$170atretailprices,and$128atwholesaleprices.ThismeansthattheTOTALcostof1000fraudulentvotes(whichcouldbeexecutedby56orfewervoters,eachvoting18timesina12-hourperiod)wouldvarybetween$148and$328atwholesaleprices,dependingontheattack.AllpricesareinU.S.dollars.Theactualcostmightbelessifpricesarelowerindevelopingcountries,andiftheequipmentcanberesoldafterwardsasusedgoods(orputtouseinscammingfutureelections).Nolaborcostswereincludedintheseestimatesastheconspiratorscanprobablyrelyonvolunteerlabor.PossibleAttackVariationsandAlternativeAttacksFortheprotectivecoatingforAttack#5,IfoundtheRevlon709mattetopcoattobethemosteffective.IalsoexperimentedwithaSallyHansenbrandBigMatteTopCoat.Thisproductislessexpensivebutdidnotprotectthefingeraswellanddidnotwetaswell.Ialsoexperimentedbrieflywithaliquidbandageavailableinpharmaciestoformaprotectivecoatingovercutsintheskin.Thismakesaveryeffectivesealwhenitdries,but


45

itisquitehydrophobicandsoisdifficulttowet.Also,itismuchmoreexpensivethaneithereggwhiteornailtopcoats,andhardertoremove.Ialsodidnottestvariousconsumersemi-water-solubleworker’shandcreams,typicallycontainingsodiumsilicate.Thesemightmakeeffectiveprotectivecoatsdespitebeingsomewhatwater-soluble. Theprofessionalnailtechnicianwhoservedasaconsultantforthisstudy[42]suggestedacrylicnailpolishasaprotectivecoat,thoughIdidnottestthis.Itismatteinappearance,muchstrongerthanconventionalnailpolishortopcoat,andcanbecleanedquicklybywipingitwithacetone.Onlythetopsurfaceoftheacrylicgetssoftenedwhendoingthis.Thefingernailmustbesoakedinacetoneforanumberofminutestototallyremovetheacrylic.ForalltheattacksIstudied,thecheatingvoterneedstoimmersethefingerinwaterand/ortheKIandKBrsolutionsasquicklyaspossible.Itisplausiblethatthiscouldactuallybedonesurreptitiouslyatthepollingplace,especiallyifthereareprivatevotingbooths.Eveniftherearenot,thevotermightbeabletoslipthefingerintoacoffeecupcontainingdistilledwateroraKIsolutionwithoutattractingmuchattention.The16%concentrationsofKIandKBrusedfortherinsesforAttacks#4a,#4b,and#5wassomewhatarbitrarilychosen.Improvedattackperformancemightbepossiblewithmoreexperimentationtodeterminetheoptimalconcentration.Similarly,thechoiceofa1%concentrationofKItocoatthefingerinAttack#4bwasalsosomewhatarbitrary.If,however,thesilvernitrateinkcomesindirectcontactwithtoohighaconcentrationofKIonthefinger,alargequantityofwhitesalt(AgI)formsinstantlyandlookssuspicious.Inadditiontousingfoamemerynailboardsandthenailgrindertoremoveanyremnantstain,inexpensivetoolssuchascuticlepushersandnippersusedatnailsalonscanhelpcleanupanyresidualstainleftonthecuticle,whichtendstogetdeeplystained.[9,15,42]Overtheyears,scientists,medicalpersonnel,andlabtechnicianshaveproposedvariouschemicalstoremovesilvernitratestainsfromthehandsandclothing.[49,51,52].Theywerenotfocusingonvotingfraud.Forexample,potassiumcyanidehasbeendiscussedasasilvernitratestainremover[51]butitisquitetoxic.Otherchemicalsthathavebeenproposedincludesodiumthiosulfatesolutions,ammoniumchloride,sodiumsulfite,andammonia.Itestedsodiumsulfiteandammoniaandfoundthemtohavelittleefficacyforsilvernitratestainsoneitherskinorthefingernail. Ididfind2otherpreviouslyproposedformulationsforremovingsilvernitratefromthehandstobefairlyeffective.TheyweretheCheer#3formulation[49],involvingafreshlypreparedaqueoussolutionofcoppersulfateandsodiumthiosulfate,andtheNolenformulation[52],whichisasolutionofsodiumsulfiteandcalciumhypochlorite(“bleachingpowder”).


46

BoththeCheer#3andtheNolenformulationsworkedmoderatelywellonskin(withvigorousbrushingusinganailbrush),butneitherformulationwasveryeffectiveatremovingsilvernitratestainsonthefingernail.Seefigure9.TheCheer#3formulationisprobablypreferabletotheNolenformulationbecausethelatterrequiresmorecausticchemicals,andcreatesanexothermicreactionthatgeneratesaconsiderableamountofheat.WhileIdidnottestthis,eitherformulationmightworkwellasareplacementfortheKIandKBrrinsesintheattacks,althoughKIandKBraresafer,easier,andlessexpensive.Figure9-PartiallyremovingsilvernitratestainsusingafreshlypreparedCheer#3formulation.[49]Atleftisa9-hour-oldsilvernitratestain,darkenedafterextensiveexposuretodirectsunlight. Ontheright isthesame finger after 10 seconds of soaking in the Cheer #3 formulation at 40° C, followed by 2 minutes ofbrushingwithanailbrushsoakedinthesolution.Notethatbecauseitisprimarilyultraviolentlight,andtoalesserextentbluelight,thatdrivesreaction{2},itisn’tfullynecessarytokeepthestainedfingerintotaldarkness.Thefingercouldpotentiallybekeptunderredlight,likeisdoneinfilmdarkrooms.Indeed,reaction{2},orthesamethingwithanothersilverhalide,isthebasisforblackandwhitefilmphotography.Countermeasures

Basedonthiswork,Icanrecommendanumberofpossiblecountermeasuresthatelectionofficialsmightbeabletousetodetectthesekindsofattacks.Thesecounter-measuresarenotexpensive,exceptpossiblyforthefirstcountermeasure,butsomemightslowdownthevotingprocess.Thecountermeasuresarelistedindecreasingorderoflikelyeffectiveness.1.Ifpractical,don’tusevoter’sinkatall,butinsteadusebiometrics,checkvoterIDs,issuevotercertificates,and/orusevotercheckoffliststopreventmultiplevoting.Thisis


47

alreadydoneinsomecountries(seereferences[10,19,20]forexample)buttheGatekeeperMaxim(seebelow)mustbeavoided.Biometricdevicesarenolongerexpensive.Therecertainlyare,however,disadvantagestousingbiometricsand/orcheckingvotersIDs.Invasionofvoterprivacy,misuseofthedata,thepossiblesuppressionofcertainvotinggroups,slowingdownthevotingprocess,andvotertechno-phobiaareveryrealconcerns.Itcanalsobequitecomplicatedtomaintain/secure/coordinatebiometricdatabases,implementcomplexverificationoridentificationprocedures,spotcounterfeitIDs,andtrainelectionofficialsontheoperationofbiometricdevices.Withavotercheckofflist,theremustbeadetailedprocedureinplacetodealwiththesituationwhenthelistindicatesavoterhaspreviouslyvoted.2.Makethepollingplaceasbrightlyilluminatedaspossible,ideallywithlightsourceshavingahighultraviolet(uv)contentlikethesunormercuryvaporlights.FluorescentlightswouldbeslightlybetterthanLEDorincandescentlights.Votingout-of-doorsisidealforcreatinganenvironmentwithhighuvilluminationbecausethesunhasalotofuvlight.3.Makesureeachvoterhashis/herfingerexposedtobrightilluminationforafewmomentsjustbeforetheyleavethepollingplace.Thishelpstodrivereaction{2}.Ideallythiswouldbedirectsunlight,orelseartificialilluminationfromaninexpensiveuv(“blacklight”)lightbulb,battery-powereduvflashlight,oramercuryvaporlamp.Alltheselightsourceshaveaconsiderableamountofuvlightthatcandarkenthesilvernitratestain.Thereasontheilluminationshouldbeattheendofthevotingprocessandnotatthebeginningormiddleisthatyouwantthemaximumbuild-upofAgClonthevoter’sfingerbeforethemajorillumination.UltravioletlightappliedbeforeAgClformsissimplywasted.4.Conversely,stainthevoter’sfingersasearlyinthevotingprocedureaspossible.ThisallowsthemaximumamountoftimeforAgCltoformasthevoterproceedsthroughthevotingprocess.Thedisadvantageofthisapproachisthatthesilvernitratestainmaygetsmearedontheballotorvotingmachine.5.Trainelectionofficialstowatchforvotersatthepollingplacewhoareclearlytryingtoprotecttheirstainedfingerfromlightbymakingafist,coveringtheirfinger,puttingongloves,usingsunscreenontheirfingertoblockuvlight,insertingthefingerintoadarkenedpurseorbagofsnackchipsorrolledupnewspaperortube.6.Watchforvoterswhoarestickingtheirfingerintowhatappearstobeacupofcoffeeorabottleofwater.Alternately,donotallowliquidsorliquidcontainersinsidethepollingplace.Theycanbeusedtowashoffthesilvernitratesoonafterstaining,ortocausethesilvernitratetoreactwithchemicalssuchasusedintheattacksdiscussedinthispaper.7.Educateelectionofficialsandthegeneralpublicaboutwhatattackslooklikesotheycanwatchforsuspiciousactivityinthepollingplaceandoutinpublic—likewearingglovesonelectiondaywhentherewouldseemtobenoreason.


48

8.Beforethevoterhasthevoter’sinkapplied,carefullycheckthatthefingerandfingernaildoesnotappearunusual,wet,greasy,damaged,orunexpectedlyglossy.(Caution:somepeople’sfingersarejustnaturallyglossyorbangedup.)9.Checkthevoter’scuticlebeforestaining,andbesurethecuticlegetsstainedbecauseitstainsdeeply.10.Protectthevoter’sinkatalltimes,bothpriortotheelectionandduringvoting.Voters,crookedelectionofficials,insideattackersattheinkfactory,orburglarscouldswapoutthevoter’sink(ortheinkpens)foraninkthatdoesnotcontainsilvernitrate.Alternately,anyonecouldputauv-absorbingchemicalintothesilvernitrateinktopreventorretardthestainfromforming,orelseputenoughsodium,lithium,orpotassiumsaltintothevoter’sinkbottletoeliminateallthesilvernitratethatisneededtogenerateafingerstain.Thesilvernitrateinkshouldbereplacedifagreatdealofprecipitateforms.11.Lookforevidencethatthevoter’sinkhasstainedtheinsidesofeitherhand(oreventheforearm).Seefigure10.Whileinnocentvotersmighthaveinadvertentlysmearedsomeofthesilvernitratefromtheirfingerwhenitwasnotfullydried,thiscouldbeanindicationofpreviousattemptstoformafistorotherwiseprotectthestainedfingerfromilluminationduringvoting.Insuchacase,thevoterwarrantsamorecarefulexamination.Figure10-Lefthandshowingstainingthatappearshoursaftervoting.Themiddlefingeronmyrighthandwasstainedwithaline,asinfigure1.Ithenformedafisttoprotectthatfinger,thenshieldeditfromlightduringthesimulatedtimeatthepollsusingthelefthandshownhere.Theinksmearedfrommyrighthandtotheleft.Therearesmalldotsonthepointerfinger(left)andalargersmudgeonthemiddlefinger(middle).Thesestraysmudgesoneitherhand—orperhapsevenaforearm—canbeindicatorsofattemptstoshieldastainedfingerfromexposuretolight.Ontheotherhand,theycanalsobetotallyinnocent.ProblemsandLimitationswithThisStudyThereareanumberofseriouslimitationsandproblemswiththisstudy.Ihadlimitedtimeandalimitedbudgetforconductingthework.Noneofmydevisedattackswerefully


49

optimized.Therewasonlyonetestsubject—myself.Theattacksmightworkdifferentlyonotherpeople.Forexample,peoplewithmuchdarkerskinpigmentationmightnotneedtodoasthoroughajobinremovingremnantsofthesilvernitratestain.Otherproblemswiththisanalysisincludethelackofquantification,amateurishphotographytorecordexperimentalresults,andnocarefulmonitoringoftheilluminationlevelsforthefingersasafunctionoftime.(Thelatterwouldnotbeeasymeasurementstomakegiventhattheilluminationisquiteangledependent).Also,mystainedfingersoftenreceivedbriefilluminationforthepurposeofphotographytodocumentthework,andthisrepresentedstain-causingilluminationthatwouldbeunnecessaryinrealvoterfraud.Mysimulatedpollingplacehadapproximately350luxofillumination,butrealpollingplacesmaybebrighter,orevenbefoundoutdoorswithbrightilluminationandhighuvlevelsfromthesun.ThemaximumamountoftimeIallowedforsimulatedvotingatthis350luxlevelwas20minutes,whichmayormaynotbereasonableforthetimespentatapollingplaceafterreceivingthevoter’sink.Ontheotherhand,votersmaybeabletosurreptitiouslyrinseoffthesilvernitratewithdistilledwateratthepollingplace,orevendoaKIrinseifelectionofficialsaren’twatching.ThiswouldgreatlydecreasetheamountofAgClavailable,andthetimeitwouldhavetoformandthendecomposeviareaction{2}.Ididmuchoftheexperimentalworkat18°C±2°C,althoughskintemperaturewasalwaystypicallyaround32°C.Presumably,theKI,KBr,andacetonerinseswouldworkbetteratwarmertemperatures.Ialsoworkedatrelativelylowhumidity.Anumberofcountriesthatusevoter’sinkarebothhotandhumid.ThisincreasesdryingtimeandmayalsocontaminatethewashedfingerwithNaClfromperspiration.Anothermajorproblemwiththisworkwasthatnocommercialvoter’sinkwasused,forreasonsdiscussedabove.The15%silvernitratesolutionIused,alongwiththewater-solublefoodcoloringdyes,presumablyareagoodanalogtorealvoter’sink.Mysimulatedvoter’sink,however,didnothavetheethanol,biocide,detergenttoimprovewettability,or(probably)thesamekindofwater-solubledyeaslikelyusedinatleastsomerealelectioninks.Also,Iusedonlya15%solutionofsilvernitrate,yetsomecountriesuseaslittleas5%andsomemorethan20%.15%,however,isatypicalconcentration.Forreasonsdiscussedpreviously,muchhigherconcentrationsdon’tmakealotofsense.Presumablytheattacksdemonstratedinthisworkwouldbeevenmoreeffectiveatlowerconcentrationsofsilvernitratebecausetherewouldbelessstaining,butthiswasnottested.AnotherproblemwiththisstudyisthatIdidnotmeasuretheuv-absorptionofthefoodcoloringdyeusedinmysimulatedvoter’sink.Ifthedyeblockeduvlighttoasignificantdegree,itmightreduceorslowdownthestainingprocess.Isawnoevidenceforthis,however.ThepureanddyedsilvernitratesolutionsIusedbehavequitesimilarly.


50

DiscussionTheattacksdemonstratedherewouldpresumablyworkforuv-fluorescentinks,orifauv-fluorescentcompoundweretobeaddedtothesilvernitrateink.Ididnottestthis,however.Noneoftheprotectivecoveringsinmyattacks(KI,eggwhite,mattetopcoat)fluorescesignificantlyunderuvlight.Thus,auvlightwouldnotrevealtheirpresence.Alloftheseattacksweresuccessfulatpreventingand/orremovingsilvernitratestains.ThesimplestAttack#1istheonlylargelynon-backdoorattackinthesensethatthereislittlepreparationbeforetheattack,unlikemyotherattacks.Attack#1worksfairlywell,butusuallyrequiressometouchupwithemeryboardorthenailgrinder.Thismaylimithowmanyre-votescanbedonewiththesamefinger.TheadvantagetofraudstersofthemorecomplexAttacks#3,#4a,#4b,and#5isthattheyaremoreconsistentlysuccessful.Moreover,theyrequirelittleornotouchups,whichresultsinquickerturnaroundandmuchlessdamagetotheskinandfingernailthanAttack#1,thusallowingmorere-voting.Theseattacksarealsomuchmoreforgivingifthevoterfailstofullyshieldthefingerfromlight,orifthevotergetsstuckatthepollingplacewaitingalongtimetovoteafterfingerstaining,and/orisdelayedingettingthefingerintorinsesandtotaldarkness.Theattacksdemonstratedhere—despitethelimitationsofthisstudy—appeartobesosuccessful,inexpensive,andeasytoexecutethatitisunlikelythatelectionofficialsnotlookingforevidenceoftheattackswoulddetectthem.Evenifelectionofficialslookfortheseattacks,andeveniftheyfollowallmyrecommendedcountermeasures(exceptpossiblythefirstoneinvolvingbiometrics),itisquestionablewhethertheycouldreliablydetectthiskindofvotingfraud.Certainlyitisunlikelythatthesefraudulentmethodscouldbedeployedtoswinganationalelection,atleastinlargecountrieswithahighvoterturnout.Thereasonisthatthiswouldrequirealargenumberofconspirators,anditisdifficulttokeepaconspiracysecretwhenlargenumbersofvotersareinvolved.Ontheotherhand,theelectioncheatersmayonlyneedtokeepthesecretuntilthepollsareclosed.Whatareelectionofficialsgoingtodoabouttheelectionresultsaftertheplotisuncovered?Evenifthefraudsterscan’teasilystealanationalelection,theymaybefullycontentwithswingingalocalelection,orevenwithgettingacandidateorapartytoreceivejustafewmorepercentofvotesthantheydeserve.Theextravotesmightallowacandidateorpoliticalpartytoreceivemoreattention,credibility,and/orfuturefundingthantheywouldreceiveinanhonestvote.Anotherwaytolookattheissue,however,isthatdemocracyisallaboutfairnessandeachpersongettingexactly1vote.Withthatphilosophy,evenasinglefraudulentvoteisunacceptable.Itisalsoimportanttonotethatthevoter’sinkmaynotbetheonlywaythatelectionofficialsinsomecountriescandetectduplicatevoting.[10,19]Whilemanycountriesandelectionjurisdictionsseemtouseonlythevoter’sinktostopduplicatevoting,others


51

theoreticallyuseadditionalsecuritymeasures.Forthesecountries,however,theremaybeastronglikelihoodofageneralphenomenonIcallthe“GatekeeperMaxim”.(Thisisamajorproblemin,myexperience,withU.S.electionsecurity,evenwithoutvoter’sink.)TheGatekeeperMaximsaysthat,althoughmultiplesecuritymeasuresmaybeinplace,theyareoftennotinvokedunlessoneandonlyoneofthemeasures(e.g.,thevoter’sink)suggeststheremightbeaproblem.[56]Inconsideringthelikelihoodofthesekindsofattacks,itisimportanttonotethatthereislittleriskforanindividualfraudulentvoter.Aftervotingthefirsttimeor(illegally)thenthtime(wheren>1),avotercanlookathis/herfingertodecideifitisprudenttoattemptanother(illegal)vote.Basedonthepreviousvote,thevoterwillknowthelevelofinspection(ifany)usedbytheelectionofficialstodetectspoofing.Asavulnerabilityassessor,Ihavefoundthatoneissueinevitablyariseswhenconductingavulnerabilityassessment:whetheritisprudenttopubliclydiscussvulnerabilitiesandattacks.Thiscanbeacomplexanddebatablematter.IhavepreviouslydevelopedaVulnerabilityDisclosureIndex(VDI)asatooltohelpthinkaboutwhether,towhom,andinwhatdetailvulnerabilityinformationshouldbeshared.[53]The(admittedlysubjective)VDIscorethatIobtained[54]byapplyingtheVDItooltothisworkwas76.5%.Withthatscore,theVDItestwouldgenerallyrecommendthattherebefullpublicdisclosureofthevulnerabilityandcountermeasuresinformation[53],asoccursinthispaper.ConclusionsIdevisedanddemonstrated6differentlow-costmethodsforspoofingsupposedly“indelible”voter’sinkbasedonsilvernitrate.Theseattackscanberepeatedanumberoftimesperdaybyeachvoter.Countermeasures,however,arepossibleandIsuggested11ofthem.Nevertheless,silvernitratestainingofvoters’fingersdoesnotappeartobeasecuremethodforpreventingfraudulentduplicatevotes.AcknowledgmentsDianaMunson,aNailTechnicianwiththeRenewSalonandSpainOswego,Illinoiscontributedideas,demonstrations,andconsiderableprofessionalexpertiseaboutfingernails,andfingernailcare,tools,chemistry,andtechnology.JanieJohnstonreviewedthepaperandofferedsuggestions.


52

NotesandReferences1.Thecountriesusingvoter’sinkincludeAfghanistan,Algeria,TheBahamas,Belize,BurkinaFaso,Burundi,Cambodia,Canada,Egypt,Ghana,Haiti,India,Iraq,Jamaica,Kenya,Lebanon,Libya,Malaysia,theMaldives,Myanmar,Nepal,Nicaragua,Nigeria,Pakistan,PapuaNewGuinea,Peru,Philippines,SaintKittsandNevis,SierraLeone,SolomonIslands,SouthAfrica,SriLanka,Sudan,Togo,Tunisia,Turkey,Venezuela,andZimbabwe.

2.Currencyexchange,commonpercentage,provesitissilverchloride.WorldofChemicals,“Chemicalsofindelibleinkusedatbankcashcounters”,November16,2016,https://www.worldofchemicals.com/media/chemicals-of-indelible-ink-used-at-bank-cash-counters/10719.html3.HindustanTimes,“MysorePaints,thecompanythatsuppliedinkduringelections,askedtostockup”,November15,2016,http://www.hindustantimes.com/india-news/mysore-paints-the-company-that-supplied-ink-during-elections-asked-to-stock-up/story-yY1eGEfLwRvgF2L4nJAsSL.html4.4GSim,“7WaystoRemoveBankIndelibleInk(ExchangeOldNoteRs500/1000)FingerNail”,November16,2016,http://www.4gsim.in/remove-rbi-bank-ink-exchange-rs-500-1000-note/5.BenBland,FinancialTimes,“IndonesiaElections,FinancialTimes,April2,2014,http://blogs.ft.com/beyond-brics/2014/04/02/indonesia-elections-nail-holes-group-voting-and-other-quirks/ 6.SolomonIslandsElectionCommission,“HowtoVote”,http://www.siec.gov.sb/index.php/voting/how-to-vote7.FoxNews,“PollsopenindivisivevoteforIndonesiacapitalgovernor”,February14,2017,http://www.foxnews.com/world/2017/02/14/polls-open-in-divisive-vote-for-indonesia-capital-governor.html

8.FuzhouOboocTechnology,“IndelibleInkSilverNitrateforElections”,http://obooc-tech.imould.com/product-402059-Indelible+Ink+Silver+Nitrate+for+Elections.htm9.Wikipedia,“Electionink”,https://en.wikipedia.org/wiki/Election_ink 10.ElectoralCommissionofJamaica,“VotingProcedures”,http://www.eoj.com.jm/content-73-96.htm11.DorianNunez,ITravelBelize,“HowtoGetRidofYourPurpleFingerAfterVoting”,March7,2016,http://itravelbelize.com/how-to-get-rid-of-your-purple-finger-after-elections/


53

12.TheHindu,“Erasevotinginkatyourownrisk”,May19,2016http://www.thehindu.com/news/national/erase-voting-ink-at-your-own-risk/article5830556.ece13.Belize7,“SurprisingSupportforAikman'sReferendum”,May17,2007,http://www.7newsbelize.com/printstory.php?func=print&nid=338214.Matchstick,“Shocking!‘Indelible’inknomatchformatchsticks”,April29,2014http://www.mid-day.com/articles/shocking-indelible-ink-no-match-for-matchsticks/15259087

15.FuzhouOboocTechnologyCo.,“IndelibleInkIntroduction”,http://www.indelibleink.com.cn/productintro/407.htm16.DailyBhaskar,“Knowwhatcausesvoter'sinktopersistformonths?”,April5,2014,http://daily.bhaskar.com/news/NAT-TOP-know-what-causes-voters-ink-to-persist-for-months-4571353-NOR.html17.TheStar,July19,2013,http://www.thestar.com.my/news/nation/2013/07/19/voters-try-dipping-fingers-into-ink/18.BorneoPost,“Scrapindelibleink,usefingerprintscannercall”,July12,2013,http://www.theborneopost.com/2013/07/12/scrap-indelible-ink-use-fingerprint-scanner-call/19.GhanaDecides,“GhanaiansheadtothepollstodaytoelectPresident,MPs“http://ghanadecides.com/2016/12/ghanaians-head-to-the-polls-today-to-elect-president-mps/20.MEC,“Pollingprocedureinby-elections”,http://www.mec.org.mw/files/column%2047-%20polling%20procedure.pdf21.LisaMuellerandLukasMatthews,“TheupcomingNigerelectionandthedramasurroundingit,explained”,WashingtonPost,February17,2016,https://www.washingtonpost.com/news/monkey-cage/wp/2016/02/17/drama-surrounds-the-niger-presidential-election-this-month-heres-why-citizens-cant-safeguard-democracy-on-their-own/?utm_term=.e2f56c8eabcb22.ACE,“ElectionIntegrity”,http://aceproject.org/main/english/ei/eix_m026.htm23.SaltLakeMetals,“SilverNitrateUses”,http://www.saltlakemetals.com/Silver_Nitrate_Uses.htm24.BorneoPost,“So,howtoremovetheindelibleink?”,May11,2016,http://www.theborneopost.com/2016/05/11/so-how-to-remove-the-indelible-ink/


54

25.OuchSonyandBenPavior,“VoterInkCanBeWashedOff,NECAdmits”,CambodiaDaily,May11,2017,https://www.cambodiadaily.com/news/voter-ink-can-be-washed-off-nec-admits-129469/26.AvantikaChilkoti,“Indiaelections:whenisindeliblevoterinknotindelible?”,FinancialTimes,May1,2014,https://www.ft.com/content/7f6a00be-d195-3974-b583-42a4798a8eee27.RGJohnstonandJSWarner,"WhatVulnerabilityAssessorsKnowThatYouShould,Too",AsiaPacificSecurityMagazine50,40-42(2013).28.RGJohnston,“AvoidingShockandAwe”,JournalofPhysicalSecurity9(1),26-48(2016).29.RGJohnstonandJSWarner,“TheDoctorWhoConundrum:WhyPlacingTooMuchFaithinTechnologyLeadstoFailure”,SecurityManagement49(9),112-121(2005).30.VictoriaFontan,VoicesfromPost-SaddamIraq,page141,GreenwoodPublishingGroup,2009.31.Guardian,“Taliban'cutofffingersoftwoAfghanvoters”,TheGuardian,August22,2009,https://www.theguardian.com/world/2009/aug/22/afghanistan-election-taliban-fingers32.IntelCenter,IntelCenterTerrorismIncidentReference(TIR):Iraq2000-2005,page271,TempestPublishing.33.BBCNews,“Inpictures:Kenyaelection”,March4,2013,http://www.bbc.co.uk/news/world-africa-2165166634. Philip Caufield, New York Daily News, “Islamic terrorists spread bloody campaignacrosscontinents“,June16,2014,http://www.nydailynews.com/news/world/islamist-terror-campaign-spans-kenya-iraq-afghanistan-article-1.183135435.SanjayKumarMishra,KaroonAgrawal,ShalabhKumar,andUpendraSharma“Indeliblevoters’inkcausingpartialthicknessburnoverthefingers”,IndianJPlastSurg.47(3),472–473,2014.https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4292141/36.Firstpost,“Outdamnspot:IstheEC'sinknotsoindelible?”,April5,2014http://www.firstpost.com/lok-sabha-election-2014/out-damn-spot-is-the-ecs-ink-not-so-indelible-1496541.html37.FMTNews,“’Fakefingers’tovote?Notpossible,saysEC”,March10,2017, http://www.freemalaysiatoday.com/category/nation/2017/03/10/fake-fingers-to-vote-not-possible-says-ec/


55

38.MiriCitySharingChannel,“RemoveElectionInkFromFingerAfterVoting“http://www.miricitysharing.com/remove-election-ink-from-finger-after-voting/39.VotingNews,“Malaysia:Amidprotests,ECinsistsindelibleinkwon’tcomeoff”,May1,2013,https://thevotingnews.com/main-malaysia-amid-protests-ec-insists-indelible-ink-wont-come-off-tue-apr-30-2013/40.PaulQuinn-Judge,“InkcontroversystainshopesforacleanelectioninthePhilippines”,ChristianScienceMonitor,May11,1984https://www.csmonitor.com/1984/0511/051134.html41.ColinClarke,Race,Class,andthePoliticsofDecolonization:JamaicaJournals,1961and1968,page130,PalgraveMacmillan,2016.42.PersonalcommunicationwithDianaMunson,aprofessionalnailtechnician.43.FreeChemistryOnline,“EffectofLightonSomeReactions”,http://www.freechemistryonline.com/effect-of-light-on-some-reactions.html44.SaltLakeMetals,“SolubilityofSilverCompoundsinWater”,http://www.saltlakemetals.com/Solubility_Of_Silver_Compounds.htm45.ScienceLab.com,“SilverNitrateMSDS”,http://www.sciencelab.com/msds.php?msdsId=992741146.ScienceLab.com,“PotassiumIodideMSDS”,http://www.sciencelab.com/msds.php?msdsId=992757147.ScienceLab.com,“PotassiumBromideMSDS”,http://www.sciencelab.com/msds.php?msdsId=992740048.ScienceLab.com,“AcetoneMSDS”,http://www.sciencelab.com/msds.php?msdsId=992706249.ClairJ.Cheer,“Removalofsilvernitratestains”,JournalofChemicalEducation58(2),201(1981).50.Ineconomics,the“marginalcost”isthecosttoproduce1moreunit.51.W.C.,“NitrateofSilverStains”,AssociationMedicalJournal1(49),1095(1853).52.O.W.Nolen,“SpotsandStains”,TheMedicalJournalofNursing20(12),962-964(1920).


56

53.RGJohnston,“AModelforHowtoDisclosePhysicalSecurityVulnerabilities”,JournalofPhysicalSecurity,3(1),17-35(2009).54.TheVDIscoresfortheFactorsAthroughRfortheseattackswere88,150,50,50,175,60,200,100,150,95,40,95,285,190,110,90,60,and155,respectively.Seereference[53]foradescriptionoftheseFactors.55.“More‘rigging’loopholesexposed”,Newsday,August9,2013,https://www.newsday.co.zw/2013/08/09/more-rigging-loopholes-exposed/56.SomefairlycommonexamplesoftheGatekeeperMaxim:notcarefullyexaminingacargosealorcheckingitsuniqueserialnumberifthesealseemstobeintact(thusignoringmostofitssecurityfeatures),orguardswhodolittleunlessanalarmsounds.

Date post:	04-Feb-2021
Category:	Documents
Upload:	others
View:	1 times
Download:	0 times

A Vulnerability Assessment of “Indelible” Voter’s Ink* · 2017. 10. 6. · Voter’s Ink...

Documents