Study, Voting Technology

Study, Voting Technology

Scope of the Project

Phase 1 - completed

  • Develop generic voting system models


Phase 2 - currently under review

  • Analyze models to identify threats
  • Use results of analysis to develop a threat assessment tool
  • Tool will assist EAC and NIST in evaluating benefits and costs of proposed security requirements for VVSG 2.0

Seven types of attacks (threats) identified

  • Attack voting equipment
  • Perform insider attack
  • Subvert voting process
  • Experience technical failure
  • Commit errors in operations
  • Attack audit
  • Disrupt operations

Voting Technologies Assessed 

Generic Technology Types

  • Precinct Count Optical Scan (PCOS)
  • Central Count Optical Scan (CCOS)
  • Vote by Mail (VBM)
  • Vote by Phone (VBP)
  • Internet Voting (IV)
  • Hand Counted Paper Ballots (HCPB)

Explanation of Terms

  • A threat tree is a method to outline each type of attack (i.e., threat) and the steps required to exploit a potential system vulnerability
  • A threat matrix documents additional information to more fully describe the nature of a threat action, its implications, and possible controls to prevent or mitigate its impact

Describing Threats

Technology threat information is described in three ways:

  • A graphical threat tree
  • A tabular threat tree
  • A threat matrix


Optical Scan (PCOS)


Tabular Threat Tree for Precinth Count Optical Scan (PCOS)



Comparison of Tabular and Graphical Trees


Comparison of Tabular and Graphical Trees

  • Both trees display the same information
  • To illustrate, the colored arrows point to the corresponding information in each tree
  • By representing trees in both tabular and graphical formats, we accommodate both textual and visual information processing styles

Example of PCOS Threat Matrix


PCOS Threat Matrix Detail


  • This matrix detail illustrates the same PCOS Attack Voting Equipment example shown in the threat trees. The entries in the matrix describe the characteristics of each threat action identified in the threat trees.

Threat Instance Risk Analyzer (TIRA) Tool

TIRA is an automated tool that allows the user to quantify his/her professional intuition/judgment about the likelihood of a given threat happening and its potential impact on election operations. The analyst can rerun the analysis multiple times using different assumptions to see how much the result changes.

How to Use TIRA

  • Analyst creates a scenario by selecting threat instances from the trees

  • Analyst uses TIRA worksheets to record scenario and assumptions
  • Analyst assigns values for parameters of motivation, complexity, and impact
  • Analyst runs TIRA simulation
  • Result is a rank ordering of threats

Benefits of TIRA

  • Organizes and structures thinking about risks
  • Enables ‘apples to apples’ comparisons of different analysts assessments
  • Allows analysis of hundreds of scenario variations in short period of time
  • Permits analyst to make changes to threat matrices to create additional scenarios

Suggestions for Reviewing Threat Trees

  • Begin with a technology you are familiar with.

  •  Compare what you know with what you see.

  • Identify any missing threat actions or other elements.

  • Remember that TIRA uses these trees as inputs for creating scenarios. If something is missing from a tree it can’t be considered in the TIRA analysis.

Review Questions for Threat Matrices

  • Do you understand the terms used in the column headings?
  • Are there other threat actions you would add?
  • Are there other mitigations / controls you would add?
  • Would you change any entries in the cells of the matrix?

If your review time is limited, feedback on the overall matrix structure is more important than comments on the individual cells.

Thank you for your time