[Paper Review] Tor is not enough: Coercion in Remote Electronic Voting Systems

Christian Meter, Alexander Schneider+2 more|arXiv (Cornell University)|Feb 9, 2017

Internet Traffic Analysis and Secure E-voting10 references3 citations

TL;DR

This paper demonstrates that low-latency anonymity networks like Tor are insufficient to ensure coercion-freeness in remote electronic voting systems. By exploiting latency-preserving traffic patterns, an attacker with access to ISP backbones can correlate voter traffic and determine whether specific voters participated in an election, thereby breaking coercion resistance despite anonymization.

ABSTRACT

Current electronic voting systems require an anonymous channel during the voting phase to prevent coercion. Typically, low-latency anonymization-networks like Tor are used for this purpose. In this paper we devise a monitoring attack that allows an attacker to monitor whether participants of an election voted, despite the use of a low-latency network during the voting phase, thereby breaking an important part of coercion-freeness. We implement a simulation carrying out our attack and measure its success rates.

Motivation & Objective

• To investigate whether low-latency anonymity networks like Tor can effectively protect against coercion in remote electronic voting systems.
• To analyze the feasibility of correlation-based traffic monitoring attacks that exploit timing and volume patterns in anonymized voting traffic.
• To evaluate the real-world practicality of such attacks using simulation and real-world network data.
• To challenge the assumption that existing e-voting systems relying on Tor are coercion-free, especially in high-surveillance environments.
• To propose alternatives to low-latency networks for achieving reliable anonymity in electronic voting.

Proposed method

• Designing a network monitoring attack model where an adversary controls an ISP backbone and observes traffic from voters using Tor.
• Implementing a discrete-event network simulator to emulate real-world voting traffic and attacker correlation techniques.
• Using pattern matching on inter-packet timing and traffic volume to correlate client-side voting activity with server-side ballot submissions.
• Simulating the attack using real-world web-browsing and voting traffic traces to assess detection accuracy under realistic conditions.
• Evaluating the success rate of the attack across different network conditions and traffic patterns.
• Comparing the performance of low-latency networks (like Tor) with high-latency alternatives (e.g., Nonesuch, Mixminion) for anonymity in e-voting.

Experimental results

Research questions

• RQ1 Can an attacker with ISP-level visibility deanonymize voters in a Tor-protected remote electronic voting system using traffic correlation?
• RQ2 To what extent does the latency-preserving nature of low-latency networks like Tor enable correlation attacks that break coercion-freeness?
• RQ3 How effective is a pattern-based traffic monitoring attack in identifying voter participation despite end-to-end encryption and Tor anonymization?
• RQ4 What are the practical limitations of using low-latency anonymity networks for ensuring coercion-freeness in large-scale electronic elections?
• RQ5 Can high-latency anonymity networks provide a viable alternative to Tor for securing remote electronic voting systems?

Key findings

• The simulation results show that an attacker with access to an ISP backbone can successfully correlate voter traffic with ballot submissions with a high degree of accuracy, even when using Tor.
• The success rate of the correlation attack is significantly higher when the attacker monitors a sufficient number of voters and observes consistent timing patterns in packet transmission.
• The use of low-latency networks like Tor does not prevent deanonymization through traffic analysis when the attacker has broad network visibility and can exploit timing and volume patterns.
• Adding random noise or dummy packets to the traffic stream does not reliably prevent the attack, as pattern-matching algorithms can still detect and adapt to such obfuscation.
• High-latency anonymity networks such as Nonesuch or Mixminion are more resilient to such correlation attacks due to their inherent delay and steganographic properties.
• Current remote electronic voting systems that rely solely on Tor for anonymity are not coercion-free and therefore unsuitable for high-stakes elections like presidential votes.