Hacking German Elections

Elections are a key element of every democracy. However, many democratic countries in the world have to face attacks on them, be it by the government or by foreign countries. Even if ballot counting has been finished, election results are often not accepted but questioned due to alleged manipulations. All these aspects pose major threats to democracy as they try to undermine the actual and publicly perceived integrity of elections. In Germany, elections are usually considered quite secure. Elections are paper-based and the subsequent ballot-counting is open to the public. The infamous introduction of electronic voting machines about ten years ago was finally stopped by the German Federal Constitutional Court. Thus, everything is human-controlled, transparent, and secure – isn’t it? Unfortunately, these claims are questionable since the silent introduction of electronic vote counting. The election system in Germany is quite complex, for example in the "Kreistagswahlen" (~district elections) workers have to count up to 70 individual votes per ballot, while respecting a special rule set. This process is very labor-intensive and sufficient election workers are often hard to come by. Due to this, electronic systems were introduced that provide support during vote counting. Election workers are no longer required to fill tally sheets, count votes, and sum them up on their own. Each ballot is simply entered into a software that performs all the magic and finally emits a result. This year, we volunteered again as election workers, but our trust in electronically-assisted elections has been vastly impacted. As IT-security researchers, we consider it our responsibility to share and discuss our concerns. We performed a thorough analysis of the concept and the hard- and software of the electronic vote counting system. We discovered several flaws on a conceptual and practical level, that can severely diminish the integrity of the election and makes it prone to manipulations. To underline the impact of the system’s vulnerabilities, we demonstrate an exemplary attack on an election. Finally, we propose different options on how to make elections secure again. We do not consider this an entirely technical case, as there are significant legal and societal circumstances that led to the deployment of this insecure system.