Despite Security Concerns, Online Voting Advances

A roll of "I Voted!" stickers are shown, Tuesday, Oct. 6, 2020, at the Miami-Dade County Elections Department in Doral, Fla.

A roll of "I Voted!" stickers are shown, Tuesday, Oct. 6, 2020, at the Miami-Dade County Elections Department in Doral, Fla. AP Photo/Wilfredo Lee

 

Connecting state and local government leaders

Online voting is likely to become more popular as technology improves and as election officials seek ways to expand access to the ballot. But security experts warn of hacking threats.

This story was originally posted by Stateline, an initiative of the Pew Charitable Trusts.

Terra Muncy has been voting for nearly four decades, but never like she did in last year’s presidential primary: sitting on her front porch, tablet in hand, tapping through the candidates on her screen.

Muncy, 57, who uses a wheelchair, was the first West Virginian with a disability to cast a ballot electronically. State residents who serve in the military or live overseas have been able to use this voting method since 2018.

At traditional polling places, Muncy said, the lines can be confusing, the building crowded and the machines set up above her reach—forcing her to strain her arms and making it difficult for her to shield her screen from onlookers.

“It was super simple,” she said of using her tablet instead. “This gave me an option to have my vote be private.”

West Virginia Secretary of State Mac Warner, a Republican, is excited that his state now offers internet-based voting as an option for people such as Muncy. In November’s election, nearly 1,600 residents cast their ballot electronically—roughly 270 voters with disabilities and 1,300 military and overseas voters.

“For those people who have been disenfranchised through no fault of their own, if we can extend electronic voting capabilities to them, I think we owe it to them to do so,” Warner told Stateline. Warner, who struggled to vote while serving in Afghanistan, knows this firsthand.

West Virginia is one of nine states where at least some jurisdictions have allowed certain voters to cast their ballots electronically, either through their home computers or through a mobile app. Mostly, election officials have opened this method of voting to residents living abroad, serving in the military or who have a disability.

The premise of online voting—receiving and returning a ballot using a device connected to the internet—is simple, and it is likely to become more popular as technology improves and some election officials seek innovative ways to expand access to the ballot. But an almost unified chorus of election security experts say the setup is ripe for ruin because of threats from malicious hackers.

“There is no level at which internet voting is entirely safe,” said Mark Lindeman, interim co-director of Verified Voting, an election security organization that advocates for voting systems that have a paper trail. “It’s just not ready yet and we don’t know how to get there.”

Facing Security Threats

This past year showed that unexpected events can upend traditional, in-person voting. The rush to mail-in voting during the pandemic also exposed the challenges that voting by mail poses for certain residents, including those with disabilities who may not be able to independently fill out and mail a paper ballot.

But election security experts say electronic voting poses significant risks. Personal devices such as smartphones and laptops are often littered with malware. A ballot could be tampered with on the voter’s device, on its way to a server or on the server of the election authority. Hostile foreign countries or other organized groups could surreptitiously change votes before they’re counted.

The threat from malicious foreign actors was recently highlighted in the Russian hack of U.S. government and corporate systems in the widespread SolarWinds attack.

Most election security experts prefer paper ballots or ballot-marking devices that have a paper trail, which allow state and local election officials to back up their results. Some online voting methods allow both the voter and the election official to print out a receipt that shows the vote was transferred. But that’s not good enough for security experts, who point out that the vote could have been corrupted in transfer.

“There’s not much that we can do to be able to detect that a problem has occurred,” said J. Alex Halderman, director of the Center for Computer Security and Society at the University of Michigan. He co-authored an analysis last year that found there is a “severe risk” to using Seattle-based voting technology company Democracy Live’s online voting platform.

Bryan Finney, founder and president of Democracy Live, was disappointed with the study because the authors of the analysis did not engage with his company before publishing the paper, he said.

Nothing can top the security of a paper ballot locked on a shelf in a warehouse, said Dan Wallach, a computer science professor at Rice University in Houston. Although programmers are getting better at building software, he said, “It’s really, really hard to build software of moderate complexity.”

Plus, Halderman said, if the 2020 elections showed anything, it’s that voters want proof that the results are right, especially if they don't trust the officials running the election. A paper trail in Georgia helped election officials audit the results of the presidential election after former President Donald Trump and his allies tried to sow doubt in Joe Biden’s victory.

Modern, scalable web services depend on storing information in the cloud, run by major tech companies. Democracy Live uses Amazon Web Services—a cloud also used by the U.S. Department of Defense. But having election results stored by a major corporation such as Amazon “would be such fodder for conspiracy theories,” Halderman said.

Some security experts understand the desire of entrepreneurs and election officials to use new voting methods to reach voters who may be disenfranchised by in-person or mail-in voting. But the security risk might be too great, they say.

“I think that because people want so badly to do right by their voters, it’s creditable to believe the vendors when they say this time they’ve solved the problems,” Verified Voting’s Lindeman said. “With internet voting, it may not be apparent how terrible it works until it's too late.”

Computer scientists laid out many of these criticisms last year, expressing fears that amid the pandemic, election officials would rush to a more accessible but potentially more dangerous method of voting.

A report from Massachusetts Institute of Technology in February claimed Voatz, a Boston-based mobile voting application used in elections in four states, had security vulnerabilities. In April, a group made up mostly of academics signed a letter from the American Association for the Advancement of Science urging state leaders not to use internet voting. 

In May, four federal agencies sent a report to state officials recommending paper ballots. In June, another MIT report, the one co-authored by Halderman, criticized the security of OmniBallot, an electronic voting system produced by Democracy Live.

A few states were pressured to make changes. West Virginia switched from Voatz to OmniBallot, though state officials say it wasn’t because of security concerns. Delaware abandoned its plan to allow absentee voters to use the OmniBallot system during its primary elections. New Jersey began using a Democracy Live product in local elections in May but stopped after a court challenge by a Rutgers Law School professor and students.

While they recognize these concerns, leaders of internet voting companies said their systems are built with sophisticated security measures that have withstood dozens of elections and millions of votes in American and foreign elections. Their goal is to make voting easier.

“Why would we want to do something that would jeopardize democracy?” Nimit Sawhney, founder and CEO of Voatz, told Stateline. In a blog post, the company argued the MIT report was flawed.

Sawhney pointed to his company’s successes last year, despite the criticism. Voatz’s application was used in the general election in two counties in Utah and one in Oregon, without any security breaches, he said. 

“In theory, yes, there are threats,” he said. “In practice, there is a way to deflect these threats.”

Finney at Democracy Live said no voting system is perfect. But ones that rely entirely on paper ignore a significant population that needs a more accessible method of casting a ballot. 

“Paper is not a panacea,” he said. “We need to have a Plan B for voting in America.”

‘Push the Needle Forward’

Amelia Powers Gardner spent three years of her childhood homeless. Her single mom moved her family from motels to couches, in search of a stable home. Her mother is also legally blind.

When Gardner is running elections as the clerk of Utah County, a community an hour south of Salt Lake City, she often thinks about her mother and others who may not have had access to the ballot because of a personal hardship.

When she was elected in 2018, Gardner promised to bring innovation to her office, relying on years running a consulting firm. That included an embrace of online voting for residents who have a disability or are living abroad or serving in the military.

Utah County uses the Voatz app, which satisfies her security standards and, she said, gives voters an alternative to an “antiquated” system that disenfranchises millions of voters. She is required by state law to accept overseas and military ballots electronically. Accepting ballots by email or fax was not secure, she said. Another 30 states and Washington, D.C., have similar laws that require election officials to accept ballots through electronic means, typically by email or fax.

“We looked for a solution,” she said. “We have the ability to serve underserved populations.”

Gardner is now one of the strongest proponents of legislation being considered in Utah that would allow municipalities to offer voters the option to vote online in local elections. Republican state Sen. Curt Bramble, the bill’s sponsor, told Stateline that lawmakers will discuss the measure later this year.

In West Virginia, disability rights advocates worked with state election officials to improve accessibility, said Regina Desmond, a senior advocate at the nonprofit Disability Rights of West Virginia. The group filmed tutorial videos and engaged with voters with disabilities to educate them on the new system.

During last year’s primary, voters who wanted to sign up for an electronic absentee ballot had to fill out a paper form, which can be difficult for certain people with disabilities. The state changed that requirement for the presidential election, allowing voters to request a ballot online.

Warner, West Virginia’s secretary of state, does not support extending online voting to the broader voting population. Voting in person at a polling location with a ballot-marking device with a paper trail remains the safest method, he said. But he is glad to continue offering the Democracy Live online voting option for the limited group of voters who have a disability, live abroad or serve in the military.

Warner wants to encourage other states and federal election officials to set standards and collaborate to make the process better. Last week, he called Oregon Secretary of State Shemia Fagan, a newly elected Democrat, to share his experience implementing this voting method.

But many election security experts doubt that online voting will ever be widely used. Halderman at the University of Michigan said that states could gradually test some online verification methods for in-person voters. But, he said, as the technology currently stands, it is far too complex for the average voter to understand how to use it.

Comments like that are one of the biggest frustrations for online voting entrepreneurs like Voatz’s Sawhney and Democracy Live’s Finney, who perceive a lack of engagement from election security experts. The entrepreneurs welcome testing and new ideas. They don’t accept the absolutist attitude that voting online will never be secure.

“I didn’t start this company to damage democracy,” Finney said. “We don’t have all the answers. Let’s work together to try to make it stronger. Let’s try to solve the problem.”

Both companies plan to continue building up their capabilities through pilot programs in cities, counties and states. They acknowledge, however, that it will take many years of testing their technology and building public confidence before the voting method will be ready for the broader public. States, they said, will also have to change their laws to allow for more internet-based voting.

It’s a slow, steady approach, Sawhney said, which can be frustrating for a startup that wants to quickly advance technology.

“Unless you try—unless you try to push the needle forward,” he said, “nothing will ever change.”

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.