[LINK] Electronic witnessing [was: High Court case Re: Register Online to Vote Should be LLegal]

[Tom Worthington]

Stephen Wilson wrote:
> Tom, you seem to be advocating no extra investment in security?  ...

No. I am suggesting not burdening the electronic system with an
inappropriate security system designed to mimic paper.

I have experienced this with worker's compensation insurance in the ACT, 
where the ACT Government required me to sign a statutory declaration to 
say how much salary my company paid out.

I suggested instead that I simply send the details electronically along 
with the payment. The electronic payment through the banking system 
would provide sufficient evidence for the electronic document. The 
government responded by saying I could send an electronic
form digitally signed. The logistics of having myself and a JP "sign" an 
electronic statutory declaration made this a very silly idea.

> The AEC might not check handwritten signatures routinely, but I bet they 
> dig them out when it comes to investigating electoral fraud ...

So you have a system which does not detect fraud, but instead might be
used if one is stumbled across? That does not sound a very useful way to
do things.

> Philip Argy's point was that there is no accepted way to even invoke an 
> 'electronic witness' much less create enough forensic certainty to 
> support AEC investigation. ...

My point is that use of such "electronic witness" is not the appropriate 
way to provide the level of certainty needed.

> Digital signatures need not be any any more complex than credit cards or 
> electronic bus tickets. ...

Melbourne seems to be currently experiencing problems with both credit
cards <http://www.abc.net.au/news/stories/2010/07/29/2967687.htm> and 
electronic transport tickets 
<http://spectrum.ieee.org/riskfactor/computing/it/australian-myki-ticketing-system-finally-rolls-out-on-trams-and-busses>.

Canberra is about to implement the "MyWay" smart card bus ticket system 
<http://www.action.act.gov.au/myway.html>. It will be interesting to see 
how that goes, given that Brisbane, Perth, Sydney and Melbourne have 
had problems. I would be happy to take a party of Canberra bus 
executives to Istanbul, so they can see how to do it properly: 
<http://www.tomw.net.au/travel/istanbul.shtml>. ;-)

> Surely if we don't do something serious now about e-authentication ...

We can be serious about e-authentication by using technology appropriate
to the job, rather than ones which mimic manual systems and are 
theoretically secure, but do not address real world problems.


-- 
Tom Worthington FACS CP HLM, TomW Communications Pty Ltd. t: 0419496150
PO Box 13, Belconnen ACT 2617, Australia  http://www.tomw.net.au