Is Your Vote Overheard? A New Scalable Side-Channel Attack Against Paper Voting

In an ongoing discussion comparing the security properties of electronic and paper voting, decreased privacy is often presented as an argument against remote Internet voting. We contribute to this discussion by presenting a side-channel attack against the physical environment of traditional paper-based elections. More precisely, we build a device based on an Arduino development board and cheap electret microphones, capable of triangulating the locations of marks made on wooden tables with high precision. In the best configuration, we are able to determine the correct cell having dimensions 4×5 cm with more than 90% accuracy. This will allow breaching privacy of ballot sheet designs that rely on the voter marking her choice(s) between a potentially high number of candidates printed on one large sheet. We complement our attack with a study on various aspects of deployment of facial recognition. This gives rise to the setup where the attacker installs cameras in the polling stations, aiming at automated detection of people leaving the voting booths. Combining the two approaches, we will have a completely automated (and hence relatively well scalable) attack against the privacy of paper-based voting.