A Design Methodology for Computer Security Testing

The field of "computer security" is often considered something in between Art and Science. This is partly due to the lack of widely agreed and standardized methodologies to evaluate the degree of the security of a system. This dissertation intends to contribute to this area by investigating the most common security testing strategies applied nowadays and by proposing an enhanced methodology that may be effectively applied to different threat scenarios with the same degree of effectiveness. Security testing methodologies are the first step towards standardized security evaluation processes and understanding of how the security threats evolve over time. This dissertation analyzes some of the most used identifying differences and commonalities, useful to compare them and assess their quality. The dissertation then proposes a new enhanced methodology built by keeping the best of every analyzed methodology. The designed methodology is tested over different systems with very effective results, which is the main evidence that it could really be applied in practical cases. Most of the dissertation discusses and proves how the presented testing methodology could be applied to such different systems and even to evade security measures by inverting goals and scopes. Real cases are often hard to find in methodology' documents, in contrary this dissertation wants to show real and practical cases offering technical details about how to apply it. Electronic voting systems are the first field test considered, and Pvote and Scantegrity are the two tested electronic voting systems. The usability and effectiveness of the designed methodology for electronic voting systems is proved thanks to this field cases analysis. Furthermore reputation and anti virus engines have also be analyzed with similar results. The dissertation concludes by presenting some general guidelines to build a coordination-based approach of electronic voting systems to improve the security without decreasing the system modularity.

Aplicación de documentos de identificación electrónica a un esquema de voto telemático a escala paneuropea, seguro, auditable y verificable.

En este trabajo de tesis se propone un esquema de votación telemática, de carácter paneuropeo y transnacional, que es capaz de satisfacer las más altas exigencias en materia de seguridad. Este enfoque transnacional supone una importante novedad que obliga a identificar a los ciudadanos más allá de las fronteras de su país, exigencia que se traduce en la necesidad de que todos los ciudadanos europeos dispongan de una identidad digital y en que ésta sea reconocida más allá de las fronteras de su país de origen. Bajo estas premisas, la propuesta recogida en esta tesis se aborda desde dos vertientes complementarias: por una parte, el diseño de un esquema de votación capaz de conquistar la confianza de gobiernos y ciudadanos europeos y, por otra, la búsqueda de una respuesta al problema de interoperabilidad de Sistemas de Gestión de Identidad (IDMs), en consonancia con los trabajos que actualmente realiza la UE para la integración de los servicios proporcionados por las Administraciones Públicas de los distintos países europeos. El punto de partida de este trabajo ha sido la identificación de los requisitos que determinan el adecuado funcionamiento de un sistema de votación telemática para, a partir de ellos,proponer un conjunto de elementos y criterios que permitan, por una parte, establecer comparaciones entre distintos sistemas telemáticos de votación y, por otra, evaluar la idoneidad del sistema propuesto. A continuación se han tomado las más recientes y significativas experiencias de votación telemática llevadas a cabo por diferentes países en la automatización de sus procesos electorales, analizándolas en profundidad para demostrar que, incluso en los sistemas más recientes, todavía subsisten importantes deficiencias relativas a la seguridad. Asimismo, se ha constatado que un sector importante de la población se muestra receloso y, a menudo, cuestiona la validez de los resultados publicados. Por tanto, un sistema que aspire a ganarse la confianza de ciudadanos y gobernantes no sólo debe operar correctamente, trasladando los procesos tradicionales de votación al contexto telemático, sino que debe proporcionar mecanismos adicionales que permitan superar los temores que inspira el nuevo sistema de votación. Conforme a este principio, el enfoque de esta tesis, se orienta, en primer lugar, hacia la creación de pruebas irrefutables, entendibles y auditables a lo largo de todo el proceso de votación, que permitan demostrar con certeza y ante todos los actores implicados en el proceso (gobierno, partidos políticos, votantes, Mesa Electoral, interventores, Junta Electoral,jueces, etc.) que los resultados publicados son fidedignos y que no se han violado los principios de anonimato y de “una persona, un voto”. Bajo este planteamiento, la solución recogida en esta tesis no sólo prevé mecanismos para minimizar el riesgo de compra de votos, sino que además incorpora mecanismos de seguridad robustos que permitirán no sólo detectar posibles intentos de manipulación del sistema, sino también identificar cuál ha sido el agente responsable. De forma adicional, esta tesis va más allá y traslada el escenario de votación a un ámbito paneuropeo donde aparecen nuevos problemas. En efecto, en la actualidad uno de los principales retos a los que se enfrentan las votaciones de carácter transnacional es sin duda la falta de procedimientos rigurosos y dinámicos para la actualización sincronizada de los censos de votantes de los distintos países que evite la presencia de errores que redunden en la incapacidad de controlar que una persona emita más de un voto, o que se vea impedido del todo a ejercer su derecho. Este reconocimiento de la identidad transnacional requiere la interoperabilidad entre los IDMs de los distintos países europeos. Para dar solución a este problema, esta tesis se apoya en las propuestas emergentes en el seno de la UE, que previsiblemente se consolidarán en los próximos años, tanto en materia de identidad digital (con la puesta en marcha de la Tarjeta de Ciudadano Europeo) como con el despliegue de una infraestructura de gestión de identidad que haga posible la interoperabilidad de los IDMs de los distintos estados miembros. A partir de ellas, en esta tesis se propone una infraestructura telemática que facilita la interoperabilidad de los sistemas de gestión de los censos de los distintos estados europeos en los que se lleve a cabo conjuntamente la votación. El resultado es un sistema versátil, seguro, totalmente robusto, fiable y auditable que puede ser aplicado en elecciones paneuropeas y que contempla la actualización dinámica del censo como una parte crítica del proceso de votación. ABSTRACT: This Ph. D. dissertation proposes a pan‐European and transnational system of telematic voting that is capable of meeting the strictest security standards. This transnational approach is a significant innovation that entails identifying citizens beyond the borders of their own country,thus requiring that all European citizens must have a digital identity that is recognized beyond the borders of their country of origin. Based on these premises, the proposal in this thesis is analyzed in two mutually‐reinforcing ways: first, a voting system is designed that is capable of winning the confidence of European governments and citizens and, second, a solution is conceived for the problem of interoperability of Identity Management Systems (IDMs) that is consistent with work being carried out by the EU to integrate the services provided by the public administrations of different European countries. The starting point of this paper is to identify the requirements for the adequate functioning of a telematic voting system and then to propose a set of elements and criteria that will allow for making comparisons between different such telematic voting systems for the purpose of evaluating the suitability of the proposed system. Then, this thesis provides an in‐depth analysis of most recent significant experiences in telematic voting carried out by different countries with the aim of automating electoral processes, and shows that even the most recent systems have significant shortcomings in the realm of security. Further, a significant portion of the population has shown itself to be wary,and they often question the validity of the published results. Therefore, a system that aspires to win the trust of citizens and leaders must not only operate correctly by transferring traditional voting processes into a telematic environment, but must also provide additional mechanisms that can overcome the fears aroused by the new voting system. Hence, this thesis focuses, first, on creating irrefutable, comprehensible and auditable proof throughout the voting process that can demonstrate to all actors in the process – the government, political parties, voters, polling station workers, electoral officials, judges, etc. ‐that the published results are accurate and that the principles of anonymity and one person,one vote, have not been violated. Accordingly, the solution in this thesis includes mechanisms to minimize the risk of vote buying, in addition to robust security mechanisms that can not only detect possible attempts to manipulate the system, but also identify the responsible party. Additionally, this thesis goes one step further and moves the voting scenario to a pan‐European scale, in which new problems appear. Indeed, one of the major challenges at present for transnational voting processes is the lack of rigorous and dynamic procedures for synchronized updating of different countries’ voter rolls, free from errors that may make the system unable to keep an individual from either casting more than one vote, or from losing the effective exercise of the right to vote. This recognition of transnational identity requires interoperability between the IDMs of different European countries. To solve the problem, this thesis relies on proposals emerging within the EU that are expected to take shape in the coming years, both in digital identity – with the launch of the European Citizen Card – and in the deployment of an identity management infrastructure that will enable interoperability of the IDMs of different member states. Based on these, the thesis proposes a telematic infrastructure that will achieve interoperability of the census management systems of European states in which voting processes are jointly carried out. The result is a versatile, secure, totally robust, reliable and auditable system that can be applied in pan‐European election, and that includes dynamic updating of the voter rolls as a critical part of the voting process.

Planteamientos sobre Sistemas de Voto y Democracia Electrónica.

This paper present a preliminary analysis of electronic voting schemes and the requirements of Electronic Democracy as a part of the work carried out by the authors in the VOTESCRIPT project (TIC2000-1630-C02). A summary of the most relevant experiences on this field are discussed and a basic classification of them is pointed out, according to different degrees on process computerization. As it is shown, most of them only take into account a technological perspective, just trying to imitate the conventional voting schemes. A citizen-base bottom-up perspective is proposed to analyze the implementation of electronic voting systems in order to avoid citizen rejection. The paper also hallmarks the new technical possibilities created to be applied to the development of citizen?s right realm. Further than conventional voting schemes, the paper proposes the use of advanced security services to extend conceptualization of Electronic Democracy in which citizens have a key role on decision making processes.

Evaluating social choice techniques into intelligent environments by agent based social simulation

The primary hypothesis stated by this paper is that the use of social choice theory in Ambient Intelligence systems can improve significantly users satisfaction when accessing shared resources. A research methodology based on agent based social simulations is employed to support this hypothesis and to evaluate these benefits. The result is a six-fold contribution summarized as follows. Firstly, several considerable differences between this application case and the most prominent social choice application, political elections, have been found and described. Secondly, given these differences, a number of metrics to evaluate different voting systems in this scope have been proposed and formalized. Thirdly, given the presented application and the metrics proposed, the performance of a number of well known electoral systems is compared. Fourthly, as a result of the performance study, a novel voting algorithm capable of obtaining the best balance between the metrics reviewed is introduced. Fifthly, to improve the social welfare in the experiments, the voting methods are combined with cluster analysis techniques. Finally, the article is complemented by a free and open-source tool, VoteSim, which ensures not only the reproducibility of the experimental results presented, but also allows the interested reader to adapt the case study presented to different environments.

Lack of Answer Estimation by Fuzzy Control

The problem of the lack of answer in questions of survey is usually dealt with different estimation and classification procedures from the answers to other questions. In this document, the results of applying fuzzy control methods for the vote -one of the variables with bigger lack of answer in opinion polls- are presented.

What’s information got to do with it? Third-party voting in plurality systems

Although strategic voting theory predicts that the number of parties will not exceed two in single-member district plurality systems, the observed number of parties often does. Previous research suggests that the reason why people vote for third parties is that they possess inaccurate information about the parties’ relative chances of winning. However, research has yet to determine whether third-party voting persists under conditions of accurate information. In this article, we examine whether possessing accurate information prevents individuals from voting for third-placed parties in the 2005 and 2010 British elections. We find that possessing accurate information does not prevent most individuals from voting for third-placed parties and that many voters possess reasonably accurate information regarding the viability of the parties in their constituencies. These findings suggest that arguments emphasizing levels of voter information as a major explanation for why multiparty systems often emerge in plurality systems are exaggerated.

Strategic Voting in Proportional Systems: The Case of Finland. IHS Political Science Series No. 138, September 2014

Voters try to avoid wasting their votes even in PR systems. In this paper we make a case that this type of strategic voting can be observed and predicted even in PR systems. Contrary to the literature we do not see weak institutional incentive structures as indicative of a hopeless endeavor for studying strategic voting. The crucial question for strategic voting is how institutional incentives constrain an individual’s decision-making process. Based on expected utility maximization we put forward a micro-logic of an individual’s expectation formation process driven by institutional and dispositional incentives. All well-known institutional incentives to vote strategically that get channelled through the district magnitude are moderated by dispositional factors in order to become relevant for voting decisions. Employing data from Finland – because of its electoral system a particularly hard testing ground - we find considerable evidence for observable implications of our theory.

Digests of various systems and plans of voting by mail.. .

Mode of access: Internet.

Reputation model based on rating data and application in recommender systems

This thesis introduced two novel reputation models to generate accurate item reputation scores using ratings data and the statistics of the dataset. It also presented an innovative method that incorporates reputation awareness in recommender systems by employing voting system methods to produce more accurate top-N item recommendations. Additionally, this thesis introduced a personalisation method for generating reputation scores based on users' interests, where a single item can have different reputation scores for different users. The personalised reputation scores are then used in the proposed reputation-aware recommender systems to enhance the recommendation quality.

Voting games with incomplete information

We examine voting situations in which individuals have incomplete information over each others' true preferences. In many respects, this work is motivated by a desire to provide a more complete understanding of so-called probabilistic voting.

Chapter 2 examines the similarities and differences between the incentives faced by politicians who seek to maximize expected vote share, expected plurality, or probability of victory in single member: single vote, simple plurality electoral systems. We find that, in general, the candidates' optimal policies in such an electoral system vary greatly depending on their objective function. We provide several examples, as well as a genericity result which states that almost all such electoral systems (with respect to the distributions of voter behavior) will exhibit different incentives for candidates who seek to maximize expected vote share and those who seek to maximize probability of victory.

In Chapter 3, we adopt a random utility maximizing framework in which individuals' preferences are subject to action-specific exogenous shocks. We show that Nash equilibria exist in voting games possessing such an information structure and in which voters and candidates are each aware that every voter's preferences are subject to such shocks. A special case of our framework is that in which voters are playing a Quantal Response Equilibrium (McKelvey and Palfrey (1995), (1998)). We then examine candidate competition in such games and show that, for sufficiently large electorates, regardless of the dimensionality of the policy space or the number of candidates, there exists a strict equilibrium at the social welfare optimum (i.e., the point which maximizes the sum of voters' utility functions). In two candidate contests we find that this equilibrium is unique.

Finally, in Chapter 4, we attempt the first steps towards a theory of equilibrium in games possessing both continuous action spaces and action-specific preference shocks. Our notion of equilibrium, Variational Response Equilibrium, is shown to exist in all games with continuous payoff functions. We discuss the similarities and differences between this notion of equilibrium and the notion of Quantal Response Equilibrium and offer possible extensions of our framework.

Biased group decision-making and the effect of computer-mediated communication: separating the effects of anonymity, voting and blind picking

The influence of communication technology on group decision-making has been examined in many studies. But the findings are inconsistent. Some studies showed a positive effect on decision quality, other studies have shown that communication technology makes the decision even worse. One possible explanation for these different findings could be the use of different Group Decision Support Systems (GDSS) in these studies, with some GDSS better fitting to the given task than others and with different sets of functions. This paper outlines an approach with an information system solely designed to examine the effect of (1) anonymity, (2) voting and (3) blind picking on decision quality, discussion quality and perceived quality of information.

'The Aftermath of the Annan Plan Referendums' Cross-Voting Moderation for Cyprus

This article examines recent developments in the Cyprus negotiations and suggests a number of changes to the proposed electoral system. Specifically, cross-voting and other electoral methods that encourage coalition-building across ethnic communities might add significantly to the functionality of the Annan Plan. Combined with other innovative mechanisms already in the plan, cross-voting could force political parties to seriously take into account the interests and concerns of the two Cypriot communities, an element that is currently missing from both the Turkish Cypriot (TC) and Greek Cypriot (GC) political systems. Special conditions on the island, as well as the way most political parties operated in the critical pre-April 2004 referendum period, suggest the need for this amendment. Although this study respects the consociational logic of the Annan Plan, it supplements consociationalism with elements that foster integration and inter-dependence between the two communities and their voters. The article also reviews the postreferendum developments in Cyprus which might have worrisome future implications, not only for its two communities, but also for EU enlargement in general. Cyprus both holds one of the keys to Turkey's entrance into the EU and is a litmus test for the Euro-Atlantic nexus and its capacity to pacify and integrate ethnically divided societies in Europe and elsewhere.

The continued salience of religious voting in the United States, Germany, and Great Britain

Conventional wisdom on party systems in advanced industrial democracies holds that modern electorates are dealigned and that social cleavages no longer structure party politics. Recent work on class cleavages has challenged this stylized fact. The analysis performed here extends this criticism to the religious-secular cleavage. Using path analysis and comparing the current electorates of the United States, Germany, and Great Britain with the early 1960s, this paper demonstrates that the religious-secular cleavage remains or has become a significant predictor of conservative vote choice. While the effects of the religious-secular cleavage on vote choice have become largely indirect, the total of the direct and indirect effects is substantial and equivalent to the effects of class and status.