Democracy can be hacked

People sort ballots for the general election before sending them to machines designed to tabulate votes at a multi-purpose badminton stadium in Yeongdeungpo District, Seoul after polls closed April 15. / Korea Times photo by Shim Hyun-chul

QR codes on ballots, tabulation sheets trigger conspiracy theory

By Kang Hyun-kyung

The Colorado secretary of state announced in September last year that the U.S. state would remove QR codes from ballots to prevent possible election meddling by outsiders.

"I am proud that Colorado continues to lead the nation in election cybersecurity," Colorado Secretary of State Jena Griswold said in a press release on Sept. 16. One of her duties is ensuring the integrity of elections. "Voters should have the utmost confidence that their vote will count. Removing QR codes from ballots will enable voters to see for themselves that their ballots are correct and helps guard against cyber meddling," Griswold went on to say.

Once QR code-less ballots are introduced, votes will be tabulated using marked ovals on the ballot.

In South Korea, QR codes have been at the center of a controversy following the April 15 National Assembly elections in which 300 lawmakers were elected and the ruling Democratic Party of Korea (DPK) clinched a landslide victory.

The two-dimensional bar codes were used twice over the course of the election; once on ballots for early and postal voting and again on voter-completed tabulation sheets printed from counting machines.

About a month has passed since the elections but some people, still scratching their heads over the results, have raised suspicions about the tabulation.

Inside the main opposition United Future Party (UFP), candidates, who failed to win, are divided. The majority have conceded defeat. They were skeptical about vote recounting, maintaining that election fraud was the least likely scenario under the current South Korean election system.

But some remain "unconvinced" about the results. Many of those who are reeling from election shock are candidates who won Election Day voting but ended up being defeated in the election after early and postal ballot boxes were opened and counted.

They went through an emotional rollercoaster that night. Some of them took legal action, requesting the court to allow ballot recounting to determine whether the results were fraudulent.

QR codes are efficient in that they are recognizable even when dirty, smudged or faded.

Despite these advantages, however, election cybersecurity expert Richard DeMillo says QR codes are "costly, unnecessary and risky features of modern voting systems," particularly in the U.S. where some states like Colorado allow the use of paper-less voting machines.

"QR codes are not readable by human beings, so voters have no idea what is actually written on their ballots when they are scanned, decreasing voter confidence in the fairness of the election process," he told The Korea Times.

DeMillo, the Charlotte B. and Roger C. Warren Chair of Computer Science and professor of management at Georgia Tech, and one of three authors of the 2019 paper titled "Ballot-Marking Devices (BMDs) Cannot Assure the Will of the Voters," says QR codes are also vulnerable to cyberattacks as hackers can install malware on ballot marking devices and make undetectable changes to the code on the printed ballot.

"QR code scanners are susceptible to many different attacks that either change the ballot so that it is fraudulent or interprets scanned characters as escape codes that cause the tabulating software to load malware," he said.

QR code / gettyimagesbank

In the South Korean National Assembly elections, QR codes were featured on early and postal voting ballots but not on those used on the election day.

The election results displayed a sharp divide between these "pre-election" votes and election day voting. In the latter, the ruling DPK and the main opposition United Future Party were in a close contest, with the UFP gaining one more seat than the ruling party.

However, that lead, albeit narrow, was reversed overnight after pre-election votes were counted. The ruling Democratic Party won 163 seats and its sister party won 17. The election results were abysmal for the main opposition UFP. Together with its sister party, the UFP secured a mere 103 seats.

A popular explanation for the unusual results states that many ruling party supporters were encouraged to turn out for early voting while conservative voters supporting the main opposition party primarily turned out on election day.

Some, however, do not buy this explanation and have begun to cast doubt on the pre-election votes.

High-tech elections vulnerable to cyberattacks

2020-05-14 12:27 | Politics

Park Young-ah, a physics professor at Myongji University in Seoul, said the odds of such an election result occurring were almost non-existent. "It's as improbable as flipping a coin 1,000 times and getting heads every single time," she wrote on Facebook, April 20. "This happened without a rigged election?"

Rep. Min Kyung-wook of the UFP alleges the April 15 elections were "fraudulent." On Monday, he claimed QR codes on the top right of tabulation sheets printed out "after machines completed ballot counting," violated the Election Law, which prohibits the use of such codes on tally sheets. / Yonhap

Conspiracy theories have mushroomed.

Election expert Walter Mebane Jr.'s analysis paper of the 2020 Korean National Assembly election has fueled suspicions about the results. Mebane Jr., a professor of political science and statistics at the University of Michigan Ann Arbor, used "eforensics" to analyze election data on the website of the National Election Commission (NEC) and found "anomalies that strongly suggest election data were fraudulently manipulated," suggesting that an investigation into what happened would be needed.

QR codes, meanwhile, pit Rep. Min Kyung-wook of the UFP against the National Election Commission (NEC).

Rep. Min alleges the April 15 elections were "fraudulent."

On Monday, he claimed QR codes on the top right of tabulation sheets printed out "after machines completed ballot counting," violated the Election Law, which prohibits the use of such codes on tally sheets.

"Once ballot boxes are opened, the machines tabulate ballots and classify them by candidate and then the result sheets are printed out," he said during a news conference at the National Assembly. "There is a standard form on which QR codes are not included. Yet QR codes were still printed on the tabulation sheets used in the April 15 elections. This is against the law."

Once scanned, the lawmaker went on to say, the QR code displays a 52-digit sequence, the last four of which read "3185." "The last four numbers are the number of ballots cast. But we don't know what the other 48 numbers are."

The lawmaker urged the NEC to disclose what kind of information was encoded in the 52-digit numbers and demonstrate how they encoded the QR codes. He also called on the prosecution to investigate what he called a sequence of suspicious numbers.

Min unsuccessfully sought re-election in the National Assembly election in Incheon's Yeonsu B district. He is one of the candidates who won Election Day voting only to lose the election after pre-election ballots were counted.

The NEC has denied the allegations.

In a press release Tuesday, the NEC said QR codes on tabulation papers were used to prevent input errors or possible mistakes, and that the sequence of numbers has basic information, such as the names of electoral districts, polling locations and other information about the ballots that were distributed to voters.

The NEC said QR codes on tabulation sheets have been used since the 2016 National Assembly elections, stressing there was absolutely no manipulation in the April 15 elections. The election watchdog expressed "deep concerns" about the conspiracy theory and those who spread baseless allegations.

But the NEC didn't clarify whether using QR codes on tallies was legal.

Richard DeMillo, the Charlotte B. and Roger C. Warren Chair of Computer Science and professor of management at Georgia Tech and one of three authors of the 2019 paper titled "Ballot-Marking Devices (BMDs) Cannot Assure the Will of the Voters"/ Courtesy of Richard DeMillo

Professor DeMillo says QR codes that are printed "before the voter casts a ballot" cannot be hacked or manipulated.

"There is no direct attack possible that would flip ballot choices," he said. "However, the QR code could contain timing information. That would allow a corrupt official to print a code that would trigger an action upon being read by a scanner. This is sometimes called an 'attack at dawn' signal. Such a signal would enable for example an attacker to shut down a polling place, although that would be difficult to carry out."

He also dismissed the possibility that the QR code could carry malware. "Such a possibility has not been demonstrated in a laboratory as far as I know. I know of no reputable researcher who considers it a serious threat," he said.

His remarks indicate that QR codes on ballots cast in paper-less voting machines, like the ones used in Colorado and some other U.S. states, are vulnerable to cyberattack, hacking or other types of manipulation and can lead to unreliable election results.

However, what he said seems to not apply to QR codes on tabulation sheets that were printed "after the machines completed counting votes."

On its website, the NEC said a tabulation machine is a simple machine designed only to count hand-marked ballots and is not connected to any external network, making hacking or manipulation of the election results impossible.

DeMillo, however, presented a different view.

"Like all computers, the scanners' tabulation software can be hacked," he said.
"If election officials retain the original hand-marked paper ballots, a risk-limiting audit can detect that kind of hacking. If the hand-marked paper ballots are not kept in a secure location or are destroyed, then no audit can detect that hacking has occurred."

David Carroll, director of Carter Center's Democracy Program, said transparency at every stage of the tabulation process is critical to the integrity of elections.

"The key to addressing concerns about manipulation of vote tabulation is to provide maximum transparency at every stage of the process, as well as consistent meaningful access for international and domestic citizen observer groups, party representatives and others, both at polling locations during the voting process and for the counting of ballots at all intermediate levels, where polling station results are tabulated into high-level summaries, as well as at the national level election headquarters," he said.