How To Remove Voter's Ink 6t5j1

Journal of Physical Security 10(1), 30-56 (2017)



A Vulnerability Assessment of “Indelible” Voter’s Ink* Roger G. Johnston, Ph.D., P Right Brain Sekurity http://rbsekurity.com



Abstract Many countries use supposedly “indelible” ink to stain a voter’s finger to prevent multiple votes by the same person. This ink is usually composed of silver nitrate, and is sometimes also used when countries replace their currency. In this study, I devise and demonstrate 6 different low-cost methods for preventing and/or removing silver nitrate stains. Though not fully optimized, all of these methods worked fairly well, and can probably be used in practice for duplicate voting multiple times per day per voter. The attacks might also work for the less common uv-fluorescent voter inks. I propose countermeasures for detecting these kinds of attacks, but it is questionable if they are adequate to detect voter fraud. This work is only preliminary and has serious limitations. Introduction At least 38 countries currently use (or have at least recently used) supposedly indelible ink during elections in an attempt to prevent fraudulent double voting.[1] Before or after casting a ballot, a voter has his or her finger stained with an ink, which is usually based on silver nitrate. The stained finger is intended to tag the voter and prevent him/her from voting more than once. Election officials must check a voter’s fingers for the absence of the silver nitrate stain before allowing them to vote. Voter’s ink has also been used to limit fraud in currency exchanges when a country shifts over to new currency.[2-4] In some countries, the little finger is stained [5, 6]; others apply the stain to the pointer (index) finger or the thumb [7-11]. In Kenya, women who are wearing nail polish can have the ink applied to the web between two fingers.[33] The silver nitrate stain typically wears off skin in about 4 to 7 days. It may take several weeks for the stain on the fingernail or cuticle to disappear.[9] The voter’s ink is applied in a number of different ways, depending on the country and election jurisdiction.[8, 9, 12, 13] Some countries have the voter dip his/her hand in the ink. In others, the ink is sprayed on, painted on with a brush or stick, or applied with a felt tip pen. For the latter, a thick line is often drawn [14-16] between the middle (or end) of the fingernail, perpendicular to the cuticle, and onto the skin, as shown in figure 1. ______________ * This paper was not peer reviewed.



30

Journal of Physical Security 10(1), 30-56 (2017)

In some countries, the voter’s ink is applied before the voter gets the ballot.[6, 11, 17-20] This tends to leave stains on the ballot or voting machine if the silver nitrate on the voter’s finger has not fully dried.[17, 18, 21] Other countries or election jurisdictions apply the voter’s silver nitrate just before the voter exits the polling place, possibly to avoid this problem.[10, 13, 22] Election officials and manufacturers of the voter’s ink frequently claim that it is difficult or “nearly impossible” or “impossible” to remove the silver nitrate stain from a finger.[14- 16, 23-25] In my experience, claims that any kind of security can’t be defeated are usually (or always?) erroneous.[27, 28] Moreover, simple attacks often work well, even against high-tech security [29] (which silver nitrate staining is not). This paper is an of a rudimentary vulnerability assessment to identify and briefly test various ways to defeat silver nitrate voter’s ink. I then propose possible countermeasures to the attacks. These are countermeasures that election officials could potentially use to reduce fraudulent voting. Another use for this information is that honest voters may want to remove silver nitrate stains after voting, including for their own security. Terrorists have reportedly attacked people with stained fingers, and domineering husbands have attacked their wives, in an attempt to discourage voting.[9, 30-32, 34] Voter’s Ink Chemistry Most or all of the supposedly “indelible” voter’s ink is made by dissolving silver nitrate, AgNO3, in water. The solution is crystal clear when the silver nitrate is pure. When applied to the skin or fingernail, the silver nitrate in the solution reacts with salt (sodium chloride) on the finger to form silver chloride (AgCl) and sodium nitrate (NaNO3) as follows: AgNO3 + NaCl AgCl + NaNO3 {1} When exposed to light, primarily ultraviolet (uv) light but to a lesser extent, blue light, the silver chloride decomposes into silver metal and chlorine (which diffuses away). See reaction {2}.

AgCl + uv light Ag + Cl {2} Both silver nitrate and sodium nitrate are highly soluble in water. AgCl is only slightly soluble, however, and silver (Ag) is not soluble in water or most solvents. The silver in reaction {2} that builds up due to the breakdown of AgCl becomes a stain that takes on various colors as it darkens, primarily grey, purple, and brown, before eventually becoming dark black with perhaps a hint of hematite red. Adding to the black color may be the tarnishing of the silver as it slowly reacts with water, sulfur, and various organic compounds on the finger. The silver nitrate stain can darken in minutes under direct sunlight, but may take an hour or more at low to moderate light levels.



31

Journal of Physical Security 10(1), 30-56 (2017)

Figure 1 shows my thumb after it was stained with a 15% (w/v) pure solution of silver nitrate, and also by the same solution with a green food color dye added (“doped in”). The two lines on the thumb are parallel. Both silver nitrate solutions were applied with a Q-tip starting on the skin, and moving up to the thumbnail, traveling perpendicular to the cuticle. This mimics the way that many countries apply the silver nitrate solution with a brush or felt tip pen. The thumb is shown after 2 hours of indoor illumination (middle) and after an additional 6.5 hours of sunlight (right). Figure 1 - Silver nitrate stains. Left: a colorless 15% silver nitrate solution was applied to the thumb (difficult to see in the photo), along with a colored version parallel to the first line. Stains are shown at 2 hours (middle photo) after illumination from indoor lighting, and after 6.5 hours of additional illumination from sunlight (at right).

Most voter’s inks [2, 9, 16], have a silver nitrate concentration of between 10% and 20% (w/v), though occasionally a 5% concentration is used [2, 8]. The greater the concentration, the faster the stain darkens, the darker it ultimately becomes, and the longer it lasts. There is little point, however, to using a concentration greater than 18% since higher concentrations do not increase the speed of appearance, the darkness of the stain, or its longevity.[9, 16] Moreover, the higher concentrations (especially > 25%) also introduce more health risks for voters and election officials. Silver nitrate is a skin and eye irritant, toxic in large quantities, and can occasionally cause significant injury.[9, 16, 23, 35, 42] It turns out to be difficult to obtain actual voter’s ink in small quantities in the United States. This is presumably due to lack of demand. Instead, I used a 15% (w/v) pure solution of silver nitrate. This was manufactured by AZ Laboratories. Voter’s ink formulations often include a water-soluble colored dye so that the solution can be initially more easily seen, especially at first application.[2, 9, 11, 14, 22] See figure 1. Without this dye, it is difficult to determine if or where the clear silver nitrate solution has been applied until the stain begins to darken via reactions {1} and {2}, which can take minutes to hours, depending on the amount of sodium chloride on the finger and the illumination level. Voter’s inks also often have a biocide to retard the growth of microorganisms.[2] Ethanol is sometimes added to speed up the drying process when the



32

Journal of Physical Security 10(1), 30-56 (2017)

ink is applied to a finger.[2, 21] Though rare, some voter’s inks include (or consist entirely of) uv-fluorescent dyes, which require an ultraviolet (uv) light to detect.[55] Previously Proposed Attacks Various attacks on the voter’s ink have been previously proposed or demonstrated by others.[11, 14, 16, 24, 25, 36-40] Many involve household chemicals. None of these methods seem likely to be effective or practical except possibly the reported method of removing the stain using a match and considerable rubbing.[14] The sulfite in the match head presumably helps with the stain removal. This attack (which I did not test) reportedly takes about 7 minutes [14] and might be impractical when the stain is applied to a large area of the finger rather than just being a stain line as in figure 1. Remarkably, none of these previously proposed attacks are “backdoor” attacks, except for the candle wax attack discussed in reference [41]. All the other methods involve trying to deal with the silver nitrate stain only after it forms. In this context, a backdoor attack involves the vote cheater treating his finger before staining in a way that prevents the stain from forming or fully forming in the first place, or in a way that at least makes it much easier to remove the stain after the silver nitrate is applied. (More generally, a backdoor attack on security involves tampering with the security design or inserting alien features in a way that permits the security to be defeated easily at a later time.) The backdoor attack discussed in reference [41] involved putting candle wax on the finger to block the silver nitrate. The wax, however, would not be very wettable, is probably not very transparent, and would likely be easily spotted by election officials based on its appearance or behavior. New Attacks I devised and tested 6 new attacks to defeat voter’s inks. They are as follows: Attack #1 - Keep the Finger in the Dark The silver nitrate stain relies upon the presence of NaCl on the finger and on light. The simplest attack is to reduce the amount of both. The protocol for this attack is as follows: 1. Wash both hands and the relevant finger thoroughly with hot water and soap to dissolve away the NaCl. (In a hot climate, it may be difficult to keep hands from perspiring so the washing should occur as close to the time of entering the polling place as possible.) 2. Once the silver nitrate ink is applied at the polling place, do whatever you can to shield the finger from light, as long as this does not attract undue attention. This can most easily be done by making a fist and/or pointing the stained portion of the finger towards the floor or your body where the finger is likely to receive less illumination. Alternately, sticking the finger in a purse, small cardboard tube, or a coffee cup might

33

Journal of Physical Security 10(1), 30-56 (2017)

substantially reduce the illumination reaching the silver nitrate without attracting notice by election officials. 3. After leaving the polling place, keep the finger in the dark to the extent practical. As soon as possible, wash the finger under low-light conditions with soap and running hot water for 20 seconds (using a nail brush) to wash off the silver nitrate. (The silver nitrate in voter’s ink is very soluble in water even after the solution dries.) 4. Quickly dry the finger and put it in total darkness by covering it with an opaque glove. A lower cost approach is to make an aluminum foil cot which is crimped on the finger, as shown in figure 2. A little masking tape can help keep the cot in place if necessary. 5. Remove the cot just before (illegally) voting the next time. If there is any slight staining on the nail or skin, remove it with a flexible, foam emery board nail file (much more effective and maneuverable than a rigid, metal nail file). Alternately, it is quicker and easier to use a relatively inexpensive electronic “nail filing system”, such as shown in figure 3. This is basically a horizontal mill with a spinning carbide wheel that can abrade a fingernail, cuticle, or nail polish (or skin). In this paper, I will call such devices “nail grinders”—inelegant terminology but essentially accurate. These nail grinders are used by professional nail technicians in many nail salons (though they don’t call them “nail grinders”), and by consumers at home. A fingernail or the skin can only be deeply abraded approximately 2-3 times by a nail grinder before it becomes too damaged.[42] 6. Repeat these steps for additional fraudulent duplicate votes by the same person. Figure 2 - A crimped aluminum foil cot to protect the stained finger from exposure to light. In this photo, it is on the pointer (index) finger of the right hand.



Figure 3 - The Kupa Manipro electric nail filing system (“nail grinder”) used in this work for demonstrations.

34

Journal of Physical Security 10(1), 30-56 (2017)

Attack #2 - Egg White Protective Coat 1. Wash both hands and the relevant finger thoroughly with hot water and soap to dissolve away the NaCl. (In a hot climate, it may be difficult to keep hands from perspiring, so the washing should occur as closely to the time of entering the polling place as possible.) Dry the finger. 2. Dip the finger in egg white from a raw chicken egg until it is well coated. Remove any air bubbles and re-dip. Allow to dry. (This can take a few minutes.) The dried egg white, which is not very water soluble, is intended to be a barrier that shields the finger from the silver nitrate. 3. As with Attack #1, once the silver nitrate is applied at the polling place, do whatever you can to shield the finger from light, as long as this does not attract undue attention. 4. After leaving the polling place, keep the finger as dark as practical. As soon as possible, wash the finger under low-light conditions with soap and running hot water for 20 seconds to wash off the silver nitrate. Use a nail brush. 5. To remove the egg white, dip the finger in raw egg white and wipe off the original egg white coating with a tissue. Liquid egg white is the best way to remove dried egg white. Do this under low-light conditions. 6. Wash the finger in hot water and soap under low-light conditions. 7. Dry the finger and put it in total darkness by covering it with an opaque glove or an aluminum foil cot. 8. Remove the glove or cot just before (illegally) voting the next time. If there is any slight staining on the nail or skin, remove it with a foam emery board nail file, or an electric nail grinder. 9. Repeat these steps for additional fraudulent votes by the same person. Attack #3 - KI Protective Coat 1. Wash both hands and the relevant finger thoroughly with hot water and soap to dissolve away the NaCl. 2. Dry the finger. 3. Brush on a 1% solution of KI in water. Allow to thoroughly dry. Since KI reacts with (and dissolves) silver nitrate, it can potentially help to keep the silver nitrate from penetrating the skin or fingernail.

35

Journal of Physical Security 10(1), 30-56 (2017)

4. Once the silver nitrate ink is applied at the polling place, do whatever you can to shield the finger from light, as long as this does not attract undue attention. 5. Upon leaving the polling place after voting, put the finger in total darkness using an opaque glove, finger cot, or some other method. 6. As soon as possible, rinse the finger in a 16% solution of KI (w/v) under low-light conditions. Brush the finger vigorously with a toothbrush wetted with the KI solution for 20 seconds. Flex the knuckles as you do this to increase penetration. 7. Still under low light conditions, repeat step 6 except use a 16% solution (w/v) of KBr and a different toothbrush. 8. Wash the finger with hot water and soap under low-light conditions, then dry the finger. 9. Place the finger in complete darkness using an opaque glove or a single finger cot made of aluminum foil or some other method. 10. Remove the glove or cot just before (illegally) voting the next time. If there is any slight staining on the nail or skin, remove it with a foam emery board nail file, or with an electric nail grinder. 11. Repeat these steps for additional fraudulent votes by the same person.

The reasoning behind the KI and KBr rinses in Attack #3 is as follows: The water in the 16% KI-water solution dissolves much of the silver nitrate off the finger, because silver nitrate is highly soluble in water. The KI in the 16% KI-water solution dissolves off much of the remaining silver nitrate by reacting with it as shown in reaction {3}. AgNO3 + KI AgI + KNO3 {3} “KI aqueous rinse” The AgI that results from reaction {3} is less light sensitive than the AgCl in {1}, so will generate less staining. (The order of silver halide light sensitivity goes AgBr > AgCl > AgI [43].) Some of the AgCl that formed via reaction {1} before the KI rinse will be dissolved by the water in the KI solution, though not much because AgCl is not very soluble. See table 1. (The sodium nitrate and potassium nitrate products formed in reactions {1} and {3}, in contrast, are highly soluble in water.) Now we could potentially stop after reaction {3}, having dissolved and consumed most of the silver nitrate, and having formed the least light sensitive silver halide (AgI). The problem, however, is that some of the silver nitrate will have been converted to AgCl via {1} in the time delay between staining the finger and doing the KI rinse. So with the KBr rinse, we dissolve out this AgCl using the water in the KBr solution (AgCl is slightly water soluble), but more importantly (see reaction {4}) we dissolve the AgCl on the finger by

36

Journal of Physical Security 10(1), 30-56 (2017)

having it react with the KBr in the solution. The downside to this KBr rinse is that it leaves us with the most light sensitive of the silver halides, AgBr, as a product. Fortunately, however, AgBr is at least a little soluble in water, plus there will be very little of it left at this point anyway. AgCl + KBr AgBr + KCl {4} “KBr aqueous rinse” The AgI formed in reaction {3} is dissolved off the finger partially with the KBr solution, but some of it forms AgBr in the KBr rinse via reaction {5} below. Again, this is not desirable because AgBr is the most light sensitive of the three silver halides; fortunately, the amount of AgBr present at that point should be quite low. Agl + KBr AgBr + Kl {5} “undesirable side reaction” Any slight stain that might appear over time after the KI and KBr rinses is probably due to whatever silver halides are left on the finger after the rinses, and whatever inaccessible silver nitrate was left on the finger. Rinsing with hot water before the KI rinse in Attack #3, and also between the KI and KBr rinses might make sense to try to reduce the silver halide products and trace amounts of silver nitrate further, but this wasn’t tested. Table 1 – The solubility of 3 silver halides in water at 25°C.[44]

silver halide AgCl AgI AgBr

solubility (mg/liter) 1.93 0.026 0.135

Attack #4a - Egg White Protective Coat with KI & KBr Rinses This attack is identical to Attack #2 except that we rinse with 16% KI and KBr solutions as is done for Attack #3. Attack #4b - 1% KI Coat + Egg White Protective Coat with KI & KBr Rinses This attack is identical to Attack #4a except that we apply a 1% KI solution (w/v) to the finger prior to the egg white coat. The finger is allowed to dry thoroughly before dipping the finger in egg white. Attack #5 - Matte Fingernail Protective Topcoat with KI & KBr Rinses

37

Journal of Physical Security 10(1), 30-56 (2017)



1. Wash both hands and the relevant finger thoroughly with hot water and soap to dissolve away the NaCl. 2. Dry the finger. 3. Brush on Revlon 790 Matte Top Coat on the finger—including on the fingernail, cuticle, and skin. (A matte coat is less glossy than regular fingernail polish or topcoat, and so less detectable. It is also better wetted by an aqueous solution of silver nitrate.) Allow to thoroughly dry. This may take several minutes. The purpose of the topcoat is to serve as a physical barrier to keep the silver nitrate from reaching the finger. 4. Once the silver nitrate ink is applied at the polling place, do whatever you can to shield the finger from light, as long as this does not attract undue attention. 5. Upon leaving the polling place after voting, put the finger in total darkness using an opaque glove, finger cot, or some other method. 6. As soon as possible, rinse the finger in a 16% solution (w/v) of KI under low-light conditions. Brush the finger vigorously with a toothbrush wetted with the KI solution for 20 seconds. Flex the knuckles as you do this for maximum penetration. 7. Still under low light conditions, repeat step 6 except use a 16% solution (w/v) of KBr and a different toothbrush. Flex the knuckles as you do this for maximum penetration. 8. Still under low-light conditions, rinse the finger in an acetone-based consumer nail polish remover. Brush vigorously with a toothbrush wetted with acetone for 20 seconds. Wipe with an acetone-soaked tissue. This removes the Revlon topcoat. 9. Wash the finger with hot water and soap under low-light conditions, then dry the finger. 10. Place the finger in complete darkness using an opaque glove or a single finger cot made of aluminum foil or some other method. 11. Remove the glove or cot just before (illegally) voting the next time. If there is any slight staining on the nail or skin, remove it with a flexible emery board nail file or with an electric nail grinder. 12. Repeat these steps for additional fraudulent votes by the same person.



38

Journal of Physical Security 10(1), 30-56 (2017)

Appearance and Wettability While it is uncertain if election officials would even notice, a protective coating made from a standard (glossy) nail polish looks suspiciously shiny, and a silver nitrate solution does not wet it well. See the middle finger in figure 4. I found that Revlon 790 fingernail matte topcoat (a popular beauty product) looks less suspicious and wets fairly well. The wettability of the egg white coating falls in between a matte and a glossy polish or topcoat. I have demonstrated that wettability can be increased for either the egg white or the matte topcoat by slightly roughing up the surface of the protective coating with an emery board (to increase the surface area), and then wiping it with an alcohol (isopropanol) pad and/or a dilute detergent solution shortly before staining. Theoretically, if the egg white or topcoat are lightly steamed, they also should become more wettable, though I did not test this. Figure 4 - Three fingers of my right hand are shown with protective coatings applied above the top knuckles, i.e., on both skin and fingernail. The photo on the left shows the coatings after they have dried. In the photo on the right, the simulated voter’s ink has been applied across the cuticle, but the (green doped) silver nitrate has not yet formed a darkened stain. The pointer finger (leftmost in either photo) has an egg white coating with a slightly glossy appearance and wets moderately well. The middle finger is coated with a standard glossy nail polish and appears quite shiny if inspected carefully. Glossy nail polishes do not wet well, which might also look suspicious at the polling place (if anybody is watching). The ring finger has a coating made from the Revlon 790 fingernail matte topcoat; it does not appear suspiciously glossy and it wets the best of the 3 coatings.

Safety Issues The KI and KBr solutions used for some of the above proposed attacks are arguably less hazardous than silver nitrate itself, which does not appear to be a particularly safe chemical to be applying to the skin of millions of voters [35, 45-47], though it is sometimes used for medical purposes [23]. Acetone also is relatively harmless in these low quantities,



39

Journal of Physical Security 10(1), 30-56 (2017)

though there is a flammability risk [48]. Acetone, however, is widely used in the home and in nail salons as a fingernail polish remover with apparently few problems. Note that either NaI or LiI could be used in place of KI, and NaBr or NaI could be used in place of KBr for the rinses, but these compounds are slightly more toxic when ingested in significant quantities than KI and KBr. Results Figure 5 shows the typical results for Attack #1. A 15% (w/v) silver nitrate solution with green food color dye was applied to my middle finger along a line perpendicular to the cuticle, as in figures 1 and 4. Immediately after staining, the finger was semi-protected from illumination for 10 minutes by forming a fist. This 10-minute period is meant to simulate the time between applying the silver nitrate ink and exiting the polling place. (Longer times didn’t change the results much.) The room illumination during this 10minute period was 350 lux—fairly typical of at least indoor U.S. polling places—and was a mix of natural light, fluorescent lights, and LED light bulbs. After the 10 minutes, the finger was rinsed in distilled water under low-light conditions. It was then kept in the dark using an aluminum cot, as in figure 2. The middle photo in figure 5 shows the finger 7.8 hours after applying silver nitrate. Some light green salt (NaCl/KI) and a small amount of silver nitrate stain can be seen. I buffed this off in 30 seconds using a foam nail emery board. The result in shown in the photo on the right. Another person could have done this touchup faster, as it is awkward to work on one’s own nails. A professional nail technician could have done it in a few seconds, with less nail scratching, as was demonstrated to me by a professional nail technician.[42]

Figure 5 - Attack #1. The washed but uncoated finger is stained with a 15% silver nitrate doped with a green dye (left) as it might be at the polling place. After being kept in the dark for 7.8 hours, the finger appeared as in the middle photo. Some light buffing removed the minor staining (right photo).



40

Journal of Physical Security 10(1), 30-56 (2017)

It is doubtful that the nail scratches seen on the rightmost photo of figure 5 would make an election official suspicious. Laborers and craftspeople often have banged up fingernails. In any event, the scratches tend to heal themselves fairly quickly as skin oil fills them. Professional nail technicians often use Jojoba oil to accomplish the same thing immediately. Figure 6 shows what happened to the finger in figure 5 after being exposed to sunlight for 5 hours more. A slight silver nitrate stain appeared. This sometimes happens for Attack #1, but would not have happened if the finger had been returned to the dark after taking the rightmost photograph in figure 5 rather than exposing the finger to sunlight. The stain on the leftmost photo in figure 6 was easily buffed off in under 30 seconds, with the result shown on the right. These late appearing, light “ghost stains” are much easier to remove than the deeper and darker stains that form on voter’s hands if no attacks are attempted. The Cheer #3 [49] solution, discussed below, can also be of help in removing the ghost stains from skin, but should not be needed unless the voter allowed the finger to receive too much light. Figure 6 - Any ghost stain that appears later (left) due to sunlight exposure can be easily buffed off (right).



Attack #2 is slightly more effective than Attack #1 in that it leaves less of a ghost stain or else none at all. The egg white (albumen) coating applied before the staining reduces the amount of silver nitrate that reaches the skin or fingernail. Figure 7 shows the successful results of Attack #3, where there are KI and KBr rinses to remove the silver nitrate and silver halides. The thumb was kept in the dark after the rinses, as is part of the Attack #3 protocol. Attacks #4a and #4b were even more effective than Attacks #1, #2, and #3, often leaving virtually no stain at all even many hours later. The KI and KBr rinses apparently effectively removed the silver nitrates and silver halides.

41

Journal of Physical Security 10(1), 30-56 (2017)

Figure 7 - This shows typical results for Attack #3. The top left photo was taken immediately after the green-dyed 15% silver nitrate solution was applied to my thumb using a Q-tip. After 6 hours in the dark, the thumb appeared as shown in the upper right photo. The light green salt stain was quickly and easily buffed off. The thumb was then returned to the dark. Lower left: at 23 hours after the silver nitrate was applied, some staining shows, but this was buffed off by me in 30 seconds with an emery board, resulting in the photo on the lower right. Some of the light staining shown in the lower left photo may have been due to the brief illumination used to take several photographs of the thumb as part of a time series. This illumination done to document the experiment would not have occurred in practice.



Figure 8 shows typical results for Attack #5. This was the most effective attack. The leftmost photo in figure 8 shows the finger immediately after staining with a 15% silver nitrate solution doped with a green dye. The middle photo shows the finger immediately after the KI/KBr rinses. There was no stain at 17 hours (not shown) with the finger kept in the dark using an aluminum foil cot. The photo on the right in figure 8 shows the finger after the cot was removed 17 hours after “voting”, and the finger was exposed to sunlight for an additional 5 hours. The very slight silver nitrate stain barely visible in the middle photo was removed quickly with a

42

Journal of Physical Security 10(1), 30-56 (2017)

foam emery board, but it is doubtful this would be necessary to fool an election official.

Figure 8 - Attack #5 using a Revlon matte topcoat. The nearly invisible silver nitrate stain seen in the middle photo that formed after 23 hours (with 5 hours of that in sunlight) was easily removed with an emery board in seconds to produce the right photo, even though this would probably not be necessary in real voting fraud.

If a finger was dipped fully into the silver nitrate solution up to 2 cm deep (instead of staining in a line as in figure 8), attack #5 produced the same results: there was no evidence of staining after 12+ hours, as long as the finger was kept in the dark. If the finger was subsequently exposed to illumination, only a very light ghost stain could be seen, and this was easy to buff out, though it took more time because a larger area was involved. Table 2 shows the estimated turnaround time for each attack, i.e., how many minutes are needed to prepare a voter for the next illegal vote. The assumption is that all materials and equipment are in place to start. Turnaround times might be longer in high-humidity climates because a significant amount of the time needed for the attacks involves thorough drying of the finger. A heat source or dehumidifier, however, could probably be used to speed up evaporation.

Table 2 - The estimated time a voter needs to be ready for another illegal duplicate vote, and the approximate number of votes possible per voter in a 12-hour period. These times ignore transportation time to and from the polling place, or long delays in the voting process.

Attack #

estimated turnaround time (mins)

approximate number of votes per voter in 12 hours

1-Keep the Finger in the Dark 2-Egg White Protective Coat 3-KI Protective Coat 4a-Egg White Protective Coat with KI & KBr Rinses 4b-1% KI Coat, Egg White Protective Coat, KI & KBr Rinses 5-Matte Fingernail Protective Topcoat with KI & KBr Rinses

7 28 25 35 40 40

100 25 25 20 18 18



43

Journal of Physical Security 10(1), 30-56 (2017)

The slowest attack would allow a voter to cast about 18 votes per 12-hour period. Duplicate votes, however, may be limited if the skin or fingernails have to be substantially ground down more than 2 times using the flexible emery boards or the electric nail grinder. Turnaround times would probably be shorter—and the cleanup of light stains quicker and better—if a professional nail technician were deployed for the attack. While I could not find any statistics on the prevalence of professional nail technicians in various countries, it appears that most or all of the countries that use voter’s ink have a large number of nail salons. Even if nail technicians were hired, however, they are usually relatively low-wage workers (despite their artistry). Thus, it is reasonable to assume that voter cheaters could have access to nail technicians to help with the voting fraud, though it is not mandatory. Attack Costs The cost of these attacks is modest. For example, the cost of the Revlon matte topcoat is less than 7¢ per finger at retail prices. All of the materials, supplies, and equipment are readily available, even in developing countries. Based on the costs of items I procured to study and demonstrate these attacks, the estimated marginal cost [50] for the most expensive attack (#5) is 54¢ per vote at retail prices. For the least expensive attack (#1), the margin cost is only 4¢ (retail). At wholesale prices, these marginal costs would be approximately 20¢ and 2¢, respectively. The marginal costs are based on the cost of consumable materials and supplies. There are also expenses for non-consumable equipment. The retail cost of the items I needed to execute the attacks—which would be sufficient for at least several thousand fraudulent votes—was $170 at retail prices, and $128 at wholesale prices. This means that the TOTAL cost of 1000 fraudulent votes (which could be executed by 56 or fewer voters, each voting 18 times in a 12-hour period) would vary between $148 and $328 at wholesale prices, depending on the attack. All prices are in U.S. dollars. The actual cost might be less if prices are lower in developing countries, and if the equipment can be resold afterwards as used goods (or put to use in scamming future elections). No labor costs were included in these estimates as the conspirators can probably rely on volunteer labor. Possible Attack Variations and Alternative Attacks For the protective coating for Attack #5, I found the Revlon 709 matte topcoat to be the most effective. I also experimented with a Sally Hansen brand Big Matte Top Coat. This product is less expensive but did not protect the finger as well and did not wet as well. I also experimented briefly with a liquid bandage available in pharmacies to form a protective coating over cuts in the skin. This makes a very effective seal when it dries, but

44

Journal of Physical Security 10(1), 30-56 (2017)

it is quite hydrophobic and so is difficult to wet. Also, it is much more expensive than either egg white or nail topcoats, and harder to remove. I also did not test various consumer semi-water-soluble worker’s hand creams, typically containing sodium silicate. These might make effective protective coats despite being somewhat water-soluble. The professional nail technician who served as a consultant for this study [42] suggested acrylic nail polish as a protective coat, though I did not test this. It is matte in appearance, much stronger than conventional nail polish or topcoat, and can be cleaned quickly by wiping it with acetone. Only the top surface of the acrylic gets softened when doing this. The fingernail must be soaked in acetone for a number of minutes to totally remove the acrylic. For all the attacks I studied, the cheating voter needs to immerse the finger in water and/or the KI and KBr solutions as quickly as possible. It is plausible that this could actually be done surreptitiously at the polling place, especially if there are private voting booths. Even if there are not, the voter might be able to slip the finger into a coffee cup containing distilled water or a KI solution without attracting much attention. The 16% concentrations of KI and KBr used for the rinses for Attacks #4a, #4b, and #5 was somewhat arbitrarily chosen. Improved attack performance might be possible with more experimentation to determine the optimal concentration. Similarly, the choice of a 1% concentration of KI to coat the finger in Attack #4b was also somewhat arbitrary. If, however, the silver nitrate ink comes in direct with too high a concentration of KI on the finger, a large quantity of white salt (AgI) forms instantly and looks suspicious. In addition to using foam emery nail boards and the nail grinder to remove any remnant stain, inexpensive tools such as cuticle pushers and nippers used at nail salons can help clean up any residual stain left on the cuticle, which tends to get deeply stained.[9, 15, 42] Over the years, scientists, medical personnel, and lab technicians have proposed various chemicals to remove silver nitrate stains from the hands and clothing.[49, 51, 52]. They were not focusing on voting fraud. For example, potassium cyanide has been discussed as a silver nitrate stain remover [51] but it is quite toxic. Other chemicals that have been proposed include sodium thiosulfate solutions, ammonium chloride, sodium sulfite, and ammonia. I tested sodium sulfite and ammonia and found them to have little efficacy for silver nitrate stains on either skin or the fingernail. I did find 2 other previously proposed formulations for removing silver nitrate from the hands to be fairly effective. They were the Cheer #3 formulation [49], involving a freshly prepared aqueous solution of copper sulfate and sodium thiosulfate, and the Nolen formulation [52], which is a solution of sodium sulfite and calcium hypochlorite (“bleaching powder”).



45

Journal of Physical Security 10(1), 30-56 (2017)

Both the Cheer #3 and the Nolen formulations worked moderately well on skin (with vigorous brushing using a nail brush), but neither formulation was very effective at removing silver nitrate stains on the fingernail. See figure 9. The Cheer #3 formulation is probably preferable to the Nolen formulation because the latter requires more caustic chemicals, and creates an exothermic reaction that generates a considerable amount of heat. While I did not test this, either formulation might work well as a replacement for the KI and KBr rinses in the attacks, although KI and KBr are safer, easier, and less expensive. Figure 9 - Partially removing silver nitrate stains using a freshly prepared Cheer #3 formulation.[49] At left is a 9-hour-old silver nitrate stain, darkened after extensive exposure to direct sunlight. On the right is the same finger after 10 seconds of soaking in the Cheer #3 formulation at 40° C, followed by 2 minutes of brushing with a nail brush soaked in the solution.

Note that because it is primarily ultraviolent light, and to a lesser extent blue light, that drives reaction {2}, it isn’t fully necessary to keep the stained finger in total darkness. The finger could potentially be kept under red light, like is done in film darkrooms. Indeed, reaction {2}, or the same thing with another silver halide, is the basis for black and white film photography. Countermeasures Based on this work, I can recommend a number of possible countermeasures that election officials might be able to use to detect these kinds of attacks. These countermeasures are not expensive, except possibly for the first countermeasure, but some might slow down the voting process. The countermeasures are listed in decreasing order of likely effectiveness. 1. If practical, don’t use voter’s ink at all, but instead use biometrics, check voter IDs, issue voter certificates, and/or use voter checkoff lists to prevent multiple voting. This is

46

Journal of Physical Security 10(1), 30-56 (2017)

already done in some countries (see references [10, 19, 20] for example) but the Gatekeeper Maxim (see below) must be avoided. Biometric devices are no longer expensive. There certainly are, however, disadvantages to using biometrics and/or checking voters IDs. Invasion of voter privacy, misuse of the data, the possible suppression of certain voting groups, slowing down the voting process, and voter techno-phobia are very real concerns. It can also be quite complicated to maintain/secure/coordinate biometric databases, implement complex verification or identification procedures, spot counterfeit IDs, and train election officials on the operation of biometric devices. With a voter checkoff list, there must be a detailed procedure in place to deal with the situation when the list indicates a voter has previously voted. 2. Make the polling place as brightly illuminated as possible, ideally with light sources having a high ultraviolet (uv) content like the sun or mercury vapor lights. Fluorescent lights would be slightly better than LED or incandescent lights. Voting out-of-doors is ideal for creating an environment with high uv illumination because the sun has a lot of uv light. 3. Make sure each voter has his/her finger exposed to bright illumination for a few moments just before they leave the polling place. This helps to drive reaction {2}. Ideally this would be direct sunlight, or else artificial illumination from an inexpensive uv (“black light”) light bulb, battery-powered uv flashlight, or a mercury vapor lamp. All these light sources have a considerable amount of uv light that can darken the silver nitrate stain. The reason the illumination should be at the end of the voting process and not at the beginning or middle is that you want the maximum build-up of AgCl on the voter’s finger before the major illumination. Ultraviolet light applied before AgCl forms is simply wasted. 4. Conversely, stain the voter’s fingers as early in the voting procedure as possible. This allows the maximum amount of time for AgCl to form as the voter proceeds through the voting process. The disadvantage of this approach is that the silver nitrate stain may get smeared on the ballot or voting machine. 5. Train election officials to watch for voters at the polling place who are clearly trying to protect their stained finger from light by making a fist, covering their finger, putting on gloves, using sunscreen on their finger to block uv light, inserting the finger into a darkened purse or bag of snack chips or rolled up newspaper or tube. 6. Watch for voters who are sticking their finger into what appears to be a cup of coffee or a bottle of water. Alternately, do not allow liquids or liquid containers inside the polling place. They can be used to wash off the silver nitrate soon after staining, or to cause the silver nitrate to react with chemicals such as used in the attacks discussed in this paper. 7. Educate election officials and the general public about what attacks look like so they can watch for suspicious activity in the polling place and out in public—like wearing gloves on election day when there would seem to be no reason.



47

Journal of Physical Security 10(1), 30-56 (2017)

8. Before the voter has the voter’s ink applied, carefully check that the finger and fingernail does not appear unusual, wet, greasy, damaged, or unexpectedly glossy. (Caution: some people’s fingers are just naturally glossy or banged up.) 9. Check the voter’s cuticle before staining, and be sure the cuticle gets stained because it stains deeply. 10. Protect the voter’s ink at all times, both prior to the election and during voting. Voters, crooked election officials, inside attackers at the ink factory, or burglars could swap out the voter’s ink (or the ink pens) for an ink that does not contain silver nitrate. Alternately, anyone could put a uv-absorbing chemical into the silver nitrate ink to prevent or retard the stain from forming, or else put enough sodium, lithium, or potassium salt into the voter’s ink bottle to eliminate all the silver nitrate that is needed to generate a finger stain. The silver nitrate ink should be replaced if a great deal of precipitate forms. 11. Look for evidence that the voter’s ink has stained the insides of either hand (or even the forearm). See figure 10. While innocent voters might have inadvertently smeared some of the silver nitrate from their finger when it was not fully dried, this could be an indication of previous attempts to form a fist or otherwise protect the stained finger from illumination during voting. In such a case, the voter warrants a more careful examination. Figure 10 - Left hand showing staining that appears hours after voting. The middle finger on my right hand was stained with a line, as in figure 1. I then formed a fist to protect that finger, then shielded it from light during the simulated time at the polls using the left hand shown here. The ink smeared from my right hand to the left. There are small dots on the pointer finger (left) and a larger smudge on the middle finger (middle). These stray smudges on either hand—or perhaps even a forearm—can be indicators of attempts to shield a stained finger from exposure to light. On the other hand, they can also be totally innocent.

Problems and Limitations with This Study There are a number of serious limitations and problems with this study. I had limited time and a limited budget for conducting the work. None of my devised attacks were fully

48

Journal of Physical Security 10(1), 30-56 (2017)

optimized. There was only one test subject—myself. The attacks might work differently on other people. For example, people with much darker skin pigmentation might not need to do as thorough a job in removing remnants of the silver nitrate stain. Other problems with this analysis include the lack of quantification, amateurish photography to record experimental results, and no careful monitoring of the illumination levels for the fingers as a function of time. (The latter would not be easy measurements to make given that the illumination is quite angle dependent). Also, my stained fingers often received brief illumination for the purpose of photography to document the work, and this represented stain-causing illumination that would be unnecessary in real voter fraud. My simulated polling place had approximately 350 lux of illumination, but real polling places may be brighter, or even be found outdoors with bright illumination and high uv levels from the sun. The maximum amount of time I allowed for simulated voting at this 350 lux level was 20 minutes, which may or may not be reasonable for the time spent at a polling place after receiving the voter’s ink. On the other hand, voters may be able to surreptitiously rinse off the silver nitrate with distilled water at the polling place, or even do a KI rinse if election officials aren’t watching. This would greatly decrease the amount of AgCl available, and the time it would have to form and then decompose via reaction {2}. I did much of the experimental work at 18°C±2°C, although skin temperature was always typically around 32° C. Presumably, the KI, KBr, and acetone rinses would work better at warmer temperatures. I also worked at relatively low humidity. A number of countries that use voter’s ink are both hot and humid. This increases drying time and may also contaminate the washed finger with NaCl from perspiration. Another major problem with this work was that no commercial voter’s ink was used, for reasons discussed above. The 15% silver nitrate solution I used, along with the watersoluble food coloring dyes, presumably are a good analog to real voter’s ink. My simulated voter’s ink, however, did not have the ethanol, biocide, detergent to improve wettability, or (probably) the same kind of water-soluble dye as likely used in at least some real election inks. Also, I used only a 15% solution of silver nitrate, yet some countries use as little as 5% and some more than 20%. 15%, however, is a typical concentration. For reasons discussed previously, much higher concentrations don’t make a lot of sense. Presumably the attacks demonstrated in this work would be even more effective at lower concentrations of silver nitrate because there would be less staining, but this was not tested. Another problem with this study is that I did not measure the uv-absorption of the food coloring dye used in my simulated voter’s ink. If the dye blocked uv light to a significant degree, it might reduce or slow down the staining process. I saw no evidence for this, however. The pure and dyed silver nitrate solutions I used behave quite similarly.

49

Journal of Physical Security 10(1), 30-56 (2017)

Discussion The attacks demonstrated here would presumably work for uv-fluorescent inks, or if a uv-fluorescent compound were to be added to the silver nitrate ink. I did not test this, however. None of the protective coverings in my attacks (KI, egg white, matte topcoat) fluoresce significantly under uv light. Thus, a uv light would not reveal their presence. All of these attacks were successful at preventing and/or removing silver nitrate stains. The simplest Attack #1 is the only largely non-backdoor attack in the sense that there is little preparation before the attack, unlike my other attacks. Attack #1 works fairly well, but usually requires some touchup with emery board or the nail grinder. This may limit how many re-votes can be done with the same finger. The advantage to fraudsters of the more complex Attacks #3, #4a, #4b, and #5 is that they are more consistently successful. Moreover, they require little or no touch ups, which results in quicker turnaround and much less damage to the skin and fingernail than Attack #1, thus allowing more re-voting. These attacks are also much more forgiving if the voter fails to fully shield the finger from light, or if the voter gets stuck at the polling place waiting a long time to vote after finger staining, and/or is delayed in getting the finger into rinses and total darkness. The attacks demonstrated here—despite the limitations of this study—appear to be so successful, inexpensive, and easy to execute that it is unlikely that election officials not looking for evidence of the attacks would detect them. Even if election officials look for these attacks, and even if they follow all my recommended countermeasures (except possibly the first one involving biometrics), it is questionable whether they could reliably detect this kind of voting fraud. Certainly it is unlikely that these fraudulent methods could be deployed to swing a national election, at least in large countries with a high voter turnout. The reason is that this would require a large number of conspirators, and it is difficult to keep a conspiracy secret when large numbers of voters are involved. On the other hand, the election cheaters may only need to keep the secret until the polls are closed. What are election officials going to do about the election results after the plot is uncovered? Even if the fraudsters can’t easily steal a national election, they may be fully content with swinging a local election, or even with getting a candidate or a party to receive just a few more percent of votes than they deserve. The extra votes might allow a candidate or political party to receive more attention, credibility, and/or future funding than they would receive in an honest vote. Another way to look at the issue, however, is that democracy is all about fairness and each person getting exactly 1 vote. With that philosophy, even a single fraudulent vote is unacceptable. It is also important to note that the voter’s ink may not be the only way that election officials in some countries can detect duplicate voting.[10, 19] While many countries and election jurisdictions seem to use only the voter’s ink to stop duplicate voting, others

50

Journal of Physical Security 10(1), 30-56 (2017)

theoretically use additional security measures. For these countries, however, there may be a strong likelihood of a general phenomenon I call the “Gatekeeper Maxim”. (This is a major problem in, my experience, with U.S. election security, even without voter’s ink.) The Gatekeeper Maxim says that, although multiple security measures may be in place, they are often not invoked unless one and only one of the measures (e.g., the voter’s ink) suggests there might be a problem.[56] In considering the likelihood of these kinds of attacks, it is important to note that there is little risk for an individual fraudulent voter. After voting the first time or (illegally) the nth time (where n>1), a voter can look at his/her finger to decide if it is prudent to attempt another (illegal) vote. Based on the previous vote, the voter will know the level of inspection (if any) used by the election officials to detect spoofing. As a vulnerability assessor, I have found that one issue inevitably arises when conducting a vulnerability assessment: whether it is prudent to publicly discuss vulnerabilities and attacks. This can be a complex and debatable matter. I have previously developed a Vulnerability Disclosure Index (VDI) as a tool to help think about whether, to whom, and in what detail vulnerability information should be shared.[53] The (ittedly subjective) VDI score that I obtained [54] by applying the VDI tool to this work was 76.5%. With that score, the VDI test would generally recommend that there be full public disclosure of the vulnerability and countermeasures information[53], as occurs in this paper. Conclusions I devised and demonstrated 6 different low-cost methods for spoofing supposedly “indelible” voter’s ink based on silver nitrate. These attacks can be repeated a number of times per day by each voter. Countermeasures, however, are possible and I suggested 11 of them. Nevertheless, silver nitrate staining of voters’ fingers does not appear to be a secure method for preventing fraudulent duplicate votes. Acknowledgments Diana Munson, a Nail Technician with the Renew Salon and Spa in Oswego, Illinois contributed ideas, demonstrations, and considerable professional expertise about fingernails, and fingernail care, tools, chemistry, and technology. Janie Johnston reviewed the paper and offered suggestions.



51

Journal of Physical Security 10(1), 30-56 (2017)

Notes and References 1. The countries using voter’s ink include Afghanistan, Algeria, The Bahamas, Belize, Burkina Faso, Burundi, Cambodia, Canada, Egypt, Ghana, Haiti, India, Iraq, Jamaica, Kenya, Lebanon, Libya, Malaysia, the Maldives, Myanmar, Nepal, Nicaragua, Nigeria, Pakistan, Papua New Guinea, Peru, Philippines, Saint Kitts and Nevis, Sierra Leone, Solomon Islands, South Africa, Sri Lanka, Sudan, Togo, Tunisia, Turkey, Venezuela, and Zimbabwe. 2. Currency exchange, common percentage, proves it is silver chloride. World of Chemicals, “Chemicals of indelible ink used at bank cash counters”, November 16, 2016, https://www.worldofchemicals.com/media/chemicals-of-indelible-ink-used-at-bank-cashcounters/10719.html 3. Hindustan Times, “Mysore Paints, the company that supplied ink during elections, asked to stock up”, November 15, 2016, http://www.hindustantimes.com/india-news/mysorepaints-the-company-that-supplied-ink-during-elections-asked-to-stock-up/storyyY1eGEfLwRvgF2L4nJAsSL.html 4. 4GSim, “7 Ways to Remove Bank Indelible Ink (Exchange Old Note Rs 500/ 1000) Finger Nail”, November 16, 2016, http://www.4gsim.in/remove-rbi-bank-ink-exchange-rs-500-1000-note/ 5. Ben Bland, Financial Times, “Indonesia Elections, Financial Times, April 2, 2014, http://blogs.ft.com/beyond-brics/2014/04/02/indonesia-elections-nail-holes-groupvoting-and-other-quirks/ 6. Solomon Islands Election Commission, “How to Vote”, http://www.siec.gov.sb/index.php/voting/how-to-vote 7. Fox News, “Polls open in divisive vote for Indonesia capital governor”, February 14, 2017, http://www.foxnews.com/world/2017/02/14/polls-open-in-divisive-vote-forindonesia-capital-governor.html 8. Fuzhou Obooc Technology, “Indelible Ink Silver Nitrate for Elections”, http://obooctech.imould.com/product-402059-Indelible+Ink+Silver+Nitrate+for+Elections.htm 9. Wikipedia, “Election ink”, https://en.wikipedia.org/wiki/Election_ink 10. Electoral Commission of Jamaica, “Voting Procedures”, http://www.eoj.com.jm/content-73-96.htm 11. Dorian Nunez, ITravelBelize, “How to Get Rid of Your Purple Finger After Voting”, March 7, 2016, http://itravelbelize.com/how-to-get-rid-of-your-purple-finger-after-elections/



52

Journal of Physical Security 10(1), 30-56 (2017)

12. The Hindu, “Erase voting ink at your own risk”, May 19, 2016 http://www.thehindu.com/news/national/erase-voting-ink-at-your-ownrisk/article5830556.ece 13. Belize 7, “Surprising for Aikman's Referendum”, May 17, 2007, http://www.7newsbelize.com/printstory.php?func=print&nid=3382 14. Matchstick, “Shocking! ‘Indelible’ ink no match for matchsticks”, April 29, 2014 http://www.mid-day.com/articles/shocking-indelible-ink-no-match-formatchsticks/15259087 15. Fuzhou Obooc Technology Co., “Indelible Ink Introduction”, http://www.indelibleink.com.cn/productintro/407.htm 16. Daily Bhaskar, “Know what causes voter's ink to persist for months?”, April 5, 2014, http://daily.bhaskar.com/news/NAT-TOP-know-what-causes-voters-ink-to-persist-formonths-4571353-NOR.html 17. The Star, July 19, 2013, http://www.thestar.com.my/news/nation/2013/07/19/voters-try-dipping-fingers-intoink/ 18. Borneo Post, “Scrap indelible ink, use fingerprint scanner call”, July 12, 2013, http://www.theborneopost.com/2013/07/12/scrap-indelible-ink-use-fingerprintscanner-call/ 19. Ghana Decides, “Ghanaians head to the polls today to elect President, MPs“ http://ghanadecides.com/2016/12/ghanaians-head-to-the-polls-today-to-elect-presidentmps/ 20. MEC, “Polling procedure in by-elections”, http://www.mec.org.mw/files/column%2047-%20polling%20procedure.pdf 21. Lisa Mueller and Lukas Matthews, “The Niger election and the drama surrounding it, explained”, Washington Post, February 17, 2016, https://www.washingtonpost.com/news/monkey-cage/wp/2016/02/17/dramasurrounds-the-niger-presidential-election-this-month-heres-why-citizens-cant-safeguarddemocracy-on-their-own/?utm_term=.e2f56c8eabcb 22. ACE, “Election Integrity”, http://aceproject.org/main/english/ei/eix_m026.htm 23. Salt Lake Metals, “Silver Nitrate Uses”, http://www.saltlakemetals.com/Silver_Nitrate_Uses.htm 24. Borneo Post, “So, how to remove the indelible ink?”, May 11, 2016, http://www.theborneopost.com/2016/05/11/so-how-to-remove-the-indelible-ink/

53

Journal of Physical Security 10(1), 30-56 (2017)

25. Ouch Sony and Ben Pavior, “Voter Ink Can Be Washed Off, NEC its”, Cambodia Daily, May 11, 2017, https://www.cambodiadaily.com/news/voter-ink-can-be-washed-offnec-its-129469/ 26. Avantika Chilkoti, “India elections: when is indelible voter ink not indelible?”, Financial Times, May 1, 2014, https://www.ft.com/content/7f6a00be-d195-3974-b583-42a4798a8eee 27. RG Johnston and JS Warner, "What Vulnerability Assessors Know That You Should, Too", Asia Pacific Security Magazine 50, 40-42 (2013). 28. RG Johnston, “Avoiding Shock and Awe”, Journal of Physical Security 9(1), 26-48 (2016). 29. RG Johnston and JS Warner, “The Doctor Who Conundrum: Why Placing Too Much Faith in Technology Leads to Failure”, Security Management 49(9), 112-121 (2005). 30. Victoria Fontan, Voices from Post-Saddam Iraq, page 141, Greenwood Publishing Group, 2009. 31. Guardian, “Taliban 'cut off fingers of two Afghan voters”, The Guardian, August 22, 2009, https://www.theguardian.com/world/2009/aug/22/afghanistan-election-taliban-fingers 32. IntelCenter, IntelCenter Terrorism Incident Reference (TIR): Iraq 2000-2005, page 271, Tempest Publishing. 33. BBC News, “In pictures: Kenya election”, March 4, 2013, http://www.bbc.co.uk/news/world-africa-21651666 34. Philip Caufield, New York Daily News, “Islamic terrorists spread bloody campaign across continents“, June 16, 2014, http://www.nydailynews.com/news/world/islamist-terror-campaign-spans-kenya-iraqafghanistan-article-1.1831354 35. Sanjay Kumar Mishra, Karoon Agrawal, Shalabh Kumar, and Upendra Sharma “Indelible voters’ ink causing partial thickness burn over the fingers”, Indian J Plast Surg. 47(3), 472–473, 2014. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4292141/ 36. Firstpost, “Out damn spot: Is the EC's ink not so indelible?”, April 5, 2014 http://www.firstpost.com/lok-sabha-election-2014/out-damn-spot-is-the-ecs-ink-not-soindelible-1496541.html 37. FMT News, “’Fake fingers’ to vote? Not possible, says EC”, March 10, 2017, http://www.freemalaysiatoday.com/category/nation/2017/03/10/fake-fingers-to-votenot-possible-says-ec/

54

Journal of Physical Security 10(1), 30-56 (2017)

38. Miri City Sharing Channel, “Remove Election Ink From Finger After Voting“ http://www.miricitysharing.com/remove-election-ink-from-finger-after-voting/ 39. Voting News, “Malaysia: Amid protests, EC insists indelible ink won’t come off”, May 1, 2013, https://thevotingnews.com/main-malaysia-amid-protests-ec-insists-indelible-ink-wontcome-off-tue-apr-30-2013/ 40. Paul Quinn-Judge, “Ink controversy stains hopes for a clean election in the Philippines”, Christian Science Monitor, May 11, 1984 https://www.csmonitor.com/1984/0511/051134.html 41. Colin Clarke, Race, Class, and the Politics of Decolonization: Jamaica Journals, 1961 and 1968, page 130, Palgrave Macmillan, 2016. 42. Personal communication with Diana Munson, a professional nail technician. 43. Free Chemistry Online, “Effect of Light on Some Reactions”, http://www.freechemistryonline.com/effect-of-light-on-some-reactions.html 44. Salt Lake Metals, “Solubility of Silver Compounds in Water”, http://www.saltlakemetals.com/Solubility_Of_Silver_Compounds.htm 45. ScienceLab.com, “Silver Nitrate MSDS”, http://www.sciencelab.com/msds.php?msdsId=9927411 46. ScienceLab.com, “Potassium IodideMSDS ”, http://www.sciencelab.com/msds.php?msdsId=9927571 47. ScienceLab.com, “Potassium Bromide MSDS”, http://www.sciencelab.com/msds.php?msdsId=9927400 48. ScienceLab.com, “Acetone MSDS”, http://www.sciencelab.com/msds.php?msdsId=9927062 49. Clair J. Cheer, “Removal of silver nitrate stains”, Journal of Chemical Education 58 (2), 201 (1981). 50. In economics, the “marginal cost” is the cost to produce 1 more unit. 51. W.C., “Nitrate of Silver Stains”, Association Medical Journal 1(49), 1095 (1853). 52. O.W. Nolen, “Spots and Stains”, The Medical Journal of Nursing 20(12), 962-964 (1920).



55

Journal of Physical Security 10(1), 30-56 (2017)

53. RG Johnston, “A Model for How to Disclose Physical Security Vulnerabilities”, Journal of Physical Security, 3(1), 17-35 (2009). 54. The VDI scores for the Factors A through R for these attacks were 88, 150, 50, 50, 175, 60, 200, 100, 150, 95, 40, 95, 285, 190, 110, 90, 60, and 155, respectively. See reference [53] for a description of these Factors. 55. “More ‘rigging’ loopholes exposed”, Newsday, August 9, 2013, https://www.newsday.co.zw/2013/08/09/more-rigging-loopholes-exposed/ 56. Some fairly common examples of the Gatekeeper Maxim: not carefully examining a cargo seal or checking its unique serial number if the seal seems to be intact (thus ignoring most of its security features), or guards who do little unless an alarm sounds.



56