A RISK ASSESSMENT STUDY ON ELECTRONIC VOTING SYSTEM FAISAL ABDULLAH SAKHAR AL AMRY MASTER OF TECHNOLOGY MANAGEMENT UNIVERSITI MALAYSIA PAHANG

Transcription

1 A RISK ASSESSMENT STUDY ON ELECTRONIC VOTING SYSTEM FAISAL ABDULLAH SAKHAR AL AMRY MASTER OF TECHNOLOGY MANAGEMENT UNIVERSITI MALAYSIA PAHANG

2 UNIVERSITI MALAYSIA PAHANG DECLARATION OF THESIS AND COPYRIGHT Author s full name : FAISAL ABDULLAH SAKHAR AL AMRY Date of birth : 25 DECEMBER 1974 Title : A RISK ASSESSMENT STUDY ON ELECTRONIC Academic Session : 2015/2016 I declare that this thesis is classified as: CONFIDENTIAL RESTRICTED OPEN ACCESS (Contains confidential information under the Official Secret Act 1972) (Contains restricted information as specified by the organization where research was done) I agree that my thesis to be published as online open access (Full text) I acknowledge that Universiti Malaysia Pahang reserve the right as follows: 1. The Thesis is the Property of Universiti Malaysia Pahang. 2. The Library of Universiti Malaysia Pahang has the right to make copies for the purpose of research only. 3. The Library has the right to make copies of the thesis for academic exchange. Certified By: (Student s Signature) (Signature of Supervisor) A DR CHENG JACK KIE New IC / Passport Number Name of Supervisor Date : Date :

3 SUPERVISORS' DECLARATION We hereby declare that we have checked this thesis and in our opinion, this thesis is adequate in terms of scope and quality for the award of the degree of Master in Project Management. (Supervisor s Signature) Full Name : DR CHENG JACK KIE Position : SENIOR LECTURER Date : SEPTEMBER 2016

4 STUDENT S DECLARATION I hereby declare that the work in this thesis is my own except for quotations and summaries, which have been duly acknowledged. The thesis has not been accepted for any degree and is not concurrently submitted for award of other degree. (Author s Signature) Name : FAISAL ABDULLAH SAKHAR AL AMRY ID Number : MPR12001 Date : SEPTEMBER 2016

5 A RISK ASSESSMENT STUDY ON ELECTRONIC VOTING SYSTEM FAISAL ABDULLAH SAKHAR AL AMRY Thesis submitted in fulfilment of the requirements For the award of the degree of Master of Technology Management Faculty of Industrial Management UNIVERSITI MALAYSIA PAHANG August 2016

6 TABLE OF CONTENTS DECLARATION TITLE PAGE DEDICATION ACKNOWLEDGEMENTS ABSTRACT ABSTRAK TABLE OF CONTENTS LIST OF TABLES LIST OF FIGURES LIST OF ABBREVIATIONS Page i ii iii iv v vi ix xi xiii CHAPTER 1 INTRODUCTION 1.1 Introduction Background Electronic Voting System Oman Government Election System Problem Statement Research Objective Research Scope Operational Definitions Operational Definitions for Risk Management Culture Operational Definitions for Respondents Profile Operational Definitions for E-voting risk factors Thesis Organization 13 CHAPTER 2 LITERATURE REVIEW 2.1 Introduction Electronic Voting (E-Voting) Paradigms E-Voting Adoption Model Direct-Recoding Electronic Voting Machine (DRE) 21 vi

7 2.5 Internet Voting (I-Voting) E-Voting Risks and Risk Assessment Security Requirements for E-Voting General Security Measurements Counter-attack Requirements Historical Perspective On E-Voting Issues The case of USA The case of Estonia Analytical Hierarchy Process(AHP) Summary 37 CHAPTER 3 METHODOLOGY 3.1 Introduction Research Design Instrument Development Survey Questionnaire I: Assessing Risk Management Culture Questionnaire II for Applying AHP Questionnaire III for assessing new e-voting system The Application of AHP in Assessing E-Voting Data Collection Method Data collection from questionnaire Data collection from AHP survey questionnaire Data Analysis Descriptive Analysis Steps of applying AHP Summary 48 CHAPTER 4 RESULTS AND DISCUSSION 4.1 Introduction Reliability Test Respondents Profile 51 vii

8 4.3.1 Job Position (Position) Educational Level Department Age Analysis of the old e-voting Process Interviews and Observations Interview Results on the Analysis of the old e-voting Process Assessment of Risk Management Culture Assessment of the old Voting System Results of AHP Analysis New e-voting System Development E-Authentication Activation Application(EAAA) Assessment of the New E-voting System Advantages of the new e-voting System Summary 79 CHAPTER 5 CONCLUSIONS AND FUTURE RECOMMENDATION 5.1 Introduction Research Summary Recommendations E- Authentication Activation Security Related Advantage of Technical IT Design Risk Mitigation Techniques Contribution of the study Limitation of the Study Future Research And Recommendations 90 REFERENCES 92 APPENDICES 97 A Questionnaire 97 B List of Publications 104 viii

9 LIST OF TABLES Table No. Title Page 2.1 Comparison of e-voting schemes Assessment of relevant attacks on e-voting systems Steps of AHP method Relative Scores Reliability Statistics Reliability Item-Total Statistics Frequencies of Job Position Variables (N=82) Frequencies of Educational Level Variables (N=82) Frequencies of Department Variables (N=82) Frequencies of Age Level Variables (N=82) Overall ranking of the factors of risk management culture Risk management effectiveness Importance of risk assessment Interest to learn about risk management Risk transfer Professional training on Risk Familiar with ISO31000 and ISO Overall ranking of the factors of risk assessment Voter cheating by ink removal Voter cheating by using different machines Voting Process Faster Security risks of e-voting system 67 ix

10 4.19 Pair-wise Comparison Standardized Matrix Results of the analysis Computing λmax Random Consistency Index Overall ranking of risk assessment factors of the new e-voting Process faster than before Paper work as an alternative of voting Voter cheating by using different machines Errors due to lack of knowledge Comparisons of the number of the voters between 2009 and Steps of Voting Process 83 x

11 LIST OF FIGURES Table No. Title Page 1.1 Risk Identification Frame E-Voting Adoption Model Security properties of voting scheme Verification overview Overview of the EVIV vote protocol phases Overview of the JCJ-scheme Research Design Old system voting hall model Risk management effectiveness Importance of risk assessment Interest to learn about risk management Risk transfer Professional training on Risk Familiar with ISO31000 and ISO Voter cheating by ink removal Voter cheating by using different machines Voting Process Faster Chosen variables of security E-authentication of citizens A sample of the voter authenticated with fingerprints Voting process is faster than before Paper work as an alternative of voting 74 xi

12 4.16 Voter cheating by using different machines Errors due to lack of knowledge Comparison of 2009 and 2013 voters Elections and Application Process Data transfer from disconnected servers Steps of risk mitigation 86 xii

13 LIST OF ABBREVIATIONS AHP DOD ROP MOI GCC OS DRE EAAA Analytic Hierarchy Process Department of Defense Royal Oman Police Ministry of Interior Cooperation Council for the Arab States of the Gulf (Saudi Arabia,UAE,Kuait,Bahran,Qatar and Oman) Operating system Direct-recoding electronic voting machine E-Authentication Activation Application xiii