Development Approach
At Assembly Voting, we strive to continuously improve and increase the quality and value of everything we do. This includes our approach to software development and the principles and methodologies we follow to support this.
Dedicated to open source and transparent development
At Assembly Voting, we are against all forms of ‘black boxing’ and we view transparency as a key guiding principle in our approach to software development.
This goes for our election software, which is end-to-end verifiable down into even the smallest details. But the philosophy also extends to the software we use in our technology stack and the way we regularly engage and collaborate with key academic researchers and relevant experts in the security community to steer us in the right direction.
Our primary technology stack consists of well-known software such as Linux, MariaDB, Nginx, Redis and Ruby On Rails. Open-source software is frequently updated. This is what keeps it safe and it is of utmost importance that security patches are applied rapidly.
Moreover, we actively seek feedback and advice from world leading election researchers and security experts during our development approach by regularly inviting them to explore system architecture, data flows and potential cyber security implications. This provides highly valuable input that we believe ultimately results in better solutions.
Test driven development
Assembly Voting is known for the highest level of election security combined with user friendly back-end and front-end interfaces. In order to maintain this status while pursuing an ambitious roadmap, we do test driven development under which all changes to our software are accompanied with extensive testing.
Every time we add a new feature or change an existing feature, we add tests that safeguard the functionality of that specific feature. Our Continuous Integration/Deployment pipeline executes these tests (together with a wide range of so-called static tests) whenever our developers commit code. In this way, we minimize the risk of introducing bugs, even in a highly paced development environment.
State of the art cryptographic foundation
Assembly Voting safeguards election data with some of the best known open source cryptographic algorithms, all available to public inspection.
There are many different cryptographic operations in our election software, but the most important one happens during the so-called Trustee Ceremony where the ability to decrypt an election is distributed among several independent people (or organizations). Creating the partial decryption keys is a tightly controlled parallel process where a master decryption key never actually exists – not even in the briefest moment in memory.
The distributed trust introduces a very high level of safety in the election process. No single individual can get access to the election keys and compromise the integrity during the setup and running of the election. Only in a situation where a threshold (which you decide) of a number of people are present will the decryption and tallying of the election be able to proceed.
Modularity and flexibility
The Assembly Voting software portfolio consists not only of our flagship products Assembly Voting X and Assembly Conference Voting, but also a number of supporting modules. For example a login module that can handle an ever expanding variety of authentication requirements and a pre-election module where candidates can register and voters can learn about the different candidates and their political viewpoints.
Assembly Voting conducts elections around the world and we are constantly faced with diverse requirements concerning the election process, especially complex authentication (how to access the election) and authorization (what content/ballots are available for a specific voter) features.
Our products are built to handle this flexibility without the need to modify the core code. Whatever the needs are we are able to tie our internal products together with third party dependencies in a way that is efficient from a cost and security perspective.