Despite Security Concerns, Online Voting Advances

West Virginia is one of nine states where at least some jurisdictions have allowed certain voters to cast their ballots electronically, either through their home computers or through a mobile app. Mostly, election officials have opened this method of voting to residents living abroad, serving in the military or who have a disability.

The premise of online voting—receiving and returning a ballot using a device connected to the internet—is simple, and it is likely to become more popular as technology improves and some election officials seek innovative ways to expand access to the ballot. But an almost unified chorus of election security experts say the setup is ripe for ruin because of threats from malicious hackers.

“There is no level at which internet voting is entirely safe,” said Mark Lindeman, interim co-director of Verified Voting, an election security organization that advocates for voting systems that have a paper trail. “It’s just not ready yet and we don’t know how to get there.”

Facing Security Threats

This past year showed that unexpected events can upend traditional, in-person voting. The rush to mail-in voting during the pandemic also exposed the challenges that voting by mail poses for certain residents, including those with disabilities who may not be able to independently fill out and mail a paper ballot.

But election security experts say electronic voting poses significant risks. Personal devices such as smartphones and laptops are often littered with malware. A ballot could be tampered with on the voter’s device, on its way to a server or on the server of the election authority. Hostile foreign countries or other organized groups could surreptitiously change votes before they’re counted.

The threat from malicious foreign actors was recently highlighted in the Russian hack of U.S. government and corporate systems in the widespread SolarWinds attack.

Most election security experts prefer paper ballots or ballot-marking devices that have a paper trail, which allow state and local election officials to back up their results. Some online voting methods allow both the voter and the election official to print out a receipt that shows the vote was transferred. But that’s not good enough for security experts, who point out that the vote could have been corrupted in transfer.

“There’s not much that we can do to be able to detect that a problem has occurred,” said J. Alex Halderman, director of the Center for Computer Security and Society at the University of Michigan. He co-authored an analysis last year that found there is a “severe risk” to using Seattle-based voting technology company Democracy Live’s online voting platform.

Bryan Finney, founder and president of Democracy Live, was disappointed with the study because the authors of the analysis did not engage with his company before publishing the paper, he said.

Nothing can top the security of a paper ballot locked on a shelf in a warehouse, said Dan Wallach, a computer science professor at Rice University in Houston. Although programmers are getting better at building software, he said, “It’s really, really hard to build software of moderate complexity.”

Plus, Halderman said, if the 2020 elections showed anything, it’s that voters want proof that the results are right, especially if they don't trust the officials running the election. A paper trail in Georgia helped election officials audit the results of the presidential election after former President Donald Trump and his allies tried to sow doubt in Joe Biden’s victory.

Modern, scalable web services depend on storing information in the cloud, run by major tech companies. Democracy Live uses Amazon Web Services—a cloud also used by the U.S. Department of Defense. But having election results stored by a major corporation such as Amazon “would be such fodder for conspiracy theories,” Halderman said.

Some security experts understand the desire of entrepreneurs and election officials to use new voting methods to reach voters who may be disenfranchised by in-person or mail-in voting. But the security risk might be too great, they say.

“I think that because people want so badly to do right by their voters, it’s creditable to believe the vendors when they say this time they’ve solved the problems,” Verified Voting’s Lindeman said. “With internet voting, it may not be apparent how terrible it works until it's too late.”

Computer scientists laid out many of these criticisms last year, expressing fears that amid the pandemic, election officials would rush to a more accessible but potentially more dangerous method of voting.

A report from Massachusetts Institute of Technology in February claimed Voatz, a Boston-based mobile voting application used in elections in four states, had security vulnerabilities. In April, a group made up mostly of academics signed a letter from the American Association for the Advancement of Science urging state leaders not to use internet voting. 

In May, four federal agencies sent a report to state officials recommending paper ballots. In June, another MIT report, the one co-authored by Halderman, criticized the security of OmniBallot, an electronic voting system produced by Democracy Live.

A few states were pressured to make changes. West Virginia switched from Voatz to OmniBallot, though state officials say it wasn’t because of security concerns. Delaware abandoned its plan to allow absentee voters to use the OmniBallot system during its primary elections. New Jersey began using a Democracy Live product in local elections in May but stopped after a court challenge by a Rutgers Law School professor and students.

While they recognize these concerns, leaders of internet voting companies said their systems are built with sophisticated security measures that have withstood dozens of elections and millions of votes in American and foreign elections. Their goal is to make voting easier.

“Why would we want to do something that would jeopardize democracy?” Nimit Sawhney, founder and CEO of Voatz, told Stateline. In a blog post, the company argued the MIT report was flawed.

Sawhney pointed to his company’s successes last year, despite the criticism. Voatz’s application was used in the general election in two counties in Utah and one in Oregon, without any security breaches, he said. 

“In theory, yes, there are threats,” he said. “In practice, there is a way to deflect these threats.”

Finney at Democracy Live said no voting system is perfect. But ones that rely entirely on paper ignore a significant population that needs a more accessible method of casting a ballot. 

“Paper is not a panacea,” he said. “We need to have a Plan B for voting in America.”

‘Push the Needle Forward’

Amelia Powers Gardner spent three years of her childhood homeless. Her single mom moved her family from motels to couches, in search of a stable home. Her mother is also legally blind.

When Gardner is running elections as the clerk of Utah County, a community an hour south of Salt Lake City, she often thinks about her mother and others who may not have had access to the ballot because of a personal hardship.

When she was elected in 2018, Gardner promised to bring innovation to her office, relying on years running a consulting firm. That included an embrace of online voting for residents who have a disability or are living abroad or serving in the military.

Utah County uses the Voatz app, which satisfies her security standards and, she said, gives voters an alternative to an “antiquated” system that disenfranchises millions of voters. She is required by state law to accept overseas and military ballots electronically. Accepting ballots by email or fax was not secure, she said. Another 30 states and Washington, D.C., have similar laws that require election officials to accept ballots through electronic means, typically by email or fax.

“We looked for a solution,” she said. “We have the ability to serve underserved populations.”

Gardner is now one of the strongest proponents of legislation being considered in Utah that would allow municipalities to offer voters the option to vote online in local elections. Republican state Sen. Curt Bramble, the bill’s sponsor, told Stateline that lawmakers will discuss the measure later this year.

In West Virginia, disability rights advocates worked with state election officials to improve accessibility, said Regina Desmond, a senior advocate at the nonprofit Disability Rights of West Virginia. The group filmed tutorial videos and engaged with voters with disabilities to educate them on the new system.

During last year’s primary, voters who wanted to sign up for an electronic absentee ballot had to fill out a paper form, which can be difficult for certain people with disabilities. The state changed that requirement for the presidential election, allowing voters to request a ballot online.

Warner, West Virginia’s secretary of state, does not support extending online voting to the broader voting population. Voting in person at a polling location with a ballot-marking device with a paper trail remains the safest method, he said. But he is glad to continue offering the Democracy Live online voting option for the limited group of voters who have a disability, live abroad or serve in the military.

Warner wants to encourage other states and federal election officials to set standards and collaborate to make the process better. Last week, he called Oregon Secretary of State Shemia Fagan, a newly elected Democrat, to share his experience implementing this voting method.

But many election security experts doubt that online voting will ever be widely used. Halderman at the University of Michigan said that states could gradually test some online verification methods for in-person voters. But, he said, as the technology currently stands, it is far too complex for the average voter to understand how to use it.

Comments like that are one of the biggest frustrations for online voting entrepreneurs like Voatz’s Sawhney and Democracy Live’s Finney, who perceive a lack of engagement from election security experts. The entrepreneurs welcome testing and new ideas. They don’t accept the absolutist attitude that voting online will never be secure.

“I didn’t start this company to damage democracy,” Finney said. “We don’t have all the answers. Let’s work together to try to make it stronger. Let’s try to solve the problem.”

Both companies plan to continue building up their capabilities through pilot programs in cities, counties and states. They acknowledge, however, that it will take many years of testing their technology and building public confidence before the voting method will be ready for the broader public. States, they said, will also have to change their laws to allow for more internet-based voting.

It’s a slow, steady approach, Sawhney said, which can be frustrating for a startup that wants to quickly advance technology.

“Unless you try—unless you try to push the needle forward,” he said, “nothing will ever change.”