FREE logo

Quick Links

Aims of the project

Download
Get Involved
Documentation
- Getting Started
- RTServer
- ERServer
- FreeClient
- Free.util
- Running Elections
- JavaDoc Docs

Contact

FREE Home
 
RUNNING ELECTIONS - A GUIDE

Running an election or referendum is an important job. FREE is designed to make it easy and secure, if you set FREE up according to our guide then the software should run smoothly. But there are more issues than merely software configuration to address, this guide gives you our recommendations for securing your electronic election as a whole.

Remember, it only takes one slip-up for public confidence to be undermined for a VERY long time - so please take the time to read this and be thorough! Thank you.

Physical Security

It may sound obvious, but we just want to remind you that having 'unhackable' servers is useless if someone can break in and physically steal/access/vandalise the hardware. So lock it up and restrict access.

Additionally be careful about who knows where the servers are and how they are connected to the power & Internet.

Performance

Hypersonic SQL (HSQL) the database system included with FREE was chosen because it is released under the General Public License and also because, like FREE, it is 100% Java.

HSQL is small and extremely fast but it does have one limitation in that it doesn't support concurrent users (though it is thread safe). This impacts FREE's performance when a large number of simultaneous voters are being served.

There are two solutions to this if you are expecting over approx. 100 voters concurrently per second: The easier option is to increase the number of Regional servers and thus spread the load but this does increase the difficulty in managing the FREE clients.

The alternative is to connect FREE to a more advanced database. This is a relatively trivial piece of programming as long as the database software supports JDBC. Take a look in DBase.java in the Free and ERServer packages to find the JDBC code.

Distribution

To create the secure system that strictly enforces privacy and security the FREE client software couldn't be a Java applet. Unfortunately this makes distributing the client software a bit more trouble. We are working on improving this through the use of JNLP, which is supported from FREE version 1.3 and up.

In the mean time we recommend that the client is distributed from multiple secure servers running SSL. Each server should offer the client specific to a certain regional server. You might also want to take advantage of Java's class signing capabilities, though this does requires certificates which are costly. For this reason we chose not to require the use of certificates.

One final thought is that FREE requires Java 1.1.8 and JFC Swing... you may need to check if your prospective users support this.

Audit

Because FREE is an open source project, it is possible that some distributions may have malicious code and/or intential security holes inserted. We strongly recommend that the source code is audited by independent professionals before use in an election/referendum to prevent such code creeping in.

This is an added expense, but any major vote should take this precaution. The release from this site will always have all code checked, but we make no warranty or guarantees of any kind.

Authentication

The current system in FREE v1.x for authenticating voters, while workable, is not ideal. We will providing more secure and flexible options in the future. In the mean time you will need to populate the Electoral Roll database with the relevant data, this may involve sending some information to voters so that they can login.

We also recommend that each region have it's own independently run ERServer to match each RTServer, thus improving survivability and performance. Additionally this compartmentalisation reduces the impact of any security breaches.

Audit Trails & Privacy

When creating secure systems one aims to prevent people gaining access, but if they do you want to make their actions traceable with an adequate audit/logging trail. This helps catch the perpetrators and also right any wrongs they might have done.

Since FREE 1.1 a logging system has been implemented for ERServer and RTServer. You can adjust how much detail is written to the log files to address privacy concerns. However even a small amount of the time-stamped information in the logs could be a privacy threat if the logs from ERServer and RTServer can be brought together for analysis.

As with most things in FREE it comes down to pragmatic compromise. The user may choose to disable logging to preserve 101% privacy but risk being caught unawares by hackers. Alternatively logging may be enabled but the user must be vigilant to prevent misuse of this data.

One other consideration is that any form of logging will result in very slightly reduced performance.

The FREE e-democracy project suggests a compromise could be to enable logging at the NORM setting, disabling DEV level logging. This could be done by DEV.removeAllAppenders() in the relevant start-up section.

The Results

Don't forget you can get sub-totals for each regional server by querying the regional database server. A new row is inserted for every vote, so you can do a row count with SQL and find out the results.

The Totaller server will provide final results automatically once it has received sub-totals from ALL the regional servers.

Note also that since v1.4 when a Regional server is made to close the ballot and send its sub-totals a verification check is performed. The number of voters registered as having voted against the number of votes registered will be displayed - this is a useful guide to the validity and possible level of error in the results.

Comments & Ideas

We are always working to improve and update this guide. Please submit your idease, comments etc.


- Docs Home -

Contact - by Jason Kitcat - j-dom portal

Copyright 2000 FREE e-democracy project.

Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.