Written By: Michael Walsh
A Byte of Online Voting
Sorry, you cannot vote online in the primaries or in presidential elections this year. That is, unless you have been selected to participate in one of the few small-scale pilot programs, such as the DemocracyLive system in Seattle, Washington, the Voatz platform in West Virginia, or most recently, the Shadow voting tool used for the 2020 Iowa caucuses just a few weeks ago. [1] These voting tools use blockchain technology to generate a unique hash for each vote. [2] To mitigate the risk of election tampering, the votes are submitted, but not counted electronically. [3] Each electronic submission is verified with a printed version of the ballot, then the printed ballots are tallied to calculate the total number of votes. [4] These electronic systems are usually deployed in areas in which voter turnouts are low or voting is only possible by remote means. [5][6] Ideally, these types of services may help improve voter turnout in the United states—a country in which less than 56% of voting-age adults participated in the 2016 presidential election. [7]
There is little federal oversight for online voting infrastructure, but Congress allocated an additional $380 million for voting infrastructure and security improvements [8], and 85% of those funds are estimated by the U.S. Elections Assistance Commission to be used by states before the 2020 election. [9][10][11] Ideally, those funds will help to alleviate problems in areas with intermittent or low bandwidth internet connections, such as some of the precincts that experienced problems with the Shadow voting app during the 2020 Iowa caucuses. [12][13][14] Additionally, a slew of other bills has been introduced to help secure elections from (predominantly foreign) interference. [15] One amendment to the Help America Vote Act (“HAVA”) of 2002, passed in December 2019, allocated an additional $400 million to help secure voting infrastructure. [16][17] However, some experts indicate that modernizing and securitizing current voting infrastructure would cost nearly $2.5 billion, not considering recurring maintenance costs. [18] To modernize Pennsylvania’s infrastructure alone is estimated to cost upwards of $150 million, which accounts for nearly half of the total HAVA funds allotted from Congress. [19]
Election Security Concerns and the 2016 Election
The costs to establish secure voting infrastructure do not seem so exorbitant when considering voter trust. The year 2016 marked the first year in which Russian interference influenced the presidential elections. [20][21][22] This foreign interference happened not by meddling with voter infrastructure (which now usually verifies electronically submitted votes with paper ballots), but by alternative means such as phishing, distributed denial-of-service (“DDoS”), and denial-of-service (“DoS”) attacks. [23][24][25] Such interference in 2016 will certainly not be the last. [26][27] In a recent national survey that asked politicians about cybersecurity risks, “[f]orty percent said they’ve had an account compromised in a phishing attack. And 60% said they haven’t significantly updated the security of their accounts since 2016.” [28] Even without direct interference with voter infrastructure, threat actors can make a meaningful difference in the outcome of elections with phishing, DDoS and DoS attacks on other vectors including campaign email accounts or insecure servers used by political groups. In response, Microsoft and Google (the companies that provide the most popular email services in the nation) have been implementing security measures to prevent these attacks. Most countermeasures focus on implementing typical information security protections, such as multi-factor authentication, tokenization, and software-based mitigation techniques, such as spoofing and phishing detection. [29][30]
Experts still have many questions about the security and privacy of electronic voting systems, most particularly those that are completely paperless. [31][32][33][34][35] Nevertheless, some voting this year will be done in select states by phone or PC through the Voatz system (but with paper ballot verification). [36] Voatz uses blockchain technology paired with biometric data from users’ phones, such as face scans and fingerprints. Although this version of multi-factor authentication may alleviate fraudulent voting, it poses serious privacy concerns [37] and does not address other salient security risks of online voting, such as phishing, DDoS, and DoS attacks. Regardless, the future of voting is likely to be a digital one, as a recent study from University of Chicago found. The survey estimated that voter turnout could increase by several percentage points [38][39], a figure that could compound with the help of universally compatible voting technology.
[1] Emily S. Rueb, Voting by Phone Gets a Big Test, but There Are Concerns, THE NEW YORK TIMES (Jan. 23, 2020), https://www.nytimes.com/2020/01/23/us/politics/mobile-voting-washington.html [https://perma.cc/B2SR-NF88].
[2] Voatz, Frequently Asked Questions, https://voatz.com/faq.html [https://perma.cc/9RBS-6BK5].
[3] Id.
[4] Id.
[5] Emily Dreyfuss, Smartphone Voting Is Happening, but No One Knows if It’s Safe, WIRED (Aug. 9, 2018), https://www.wired.com/story/smartphone-voting-is-happening-west-virginia/ [https://perma.cc/JC2B-SYWF].
[6] Rueb, supra note 1.
[7] Drew Desilver, U.S. Trails Most Developed Countries in Voter Turnout, PEW RESEARCH CENTER (May, 21 2018), https://www.pewresearch.org/fact-tank/2018/05/21/u-s-voter-turnout-trails-most-developed-countries/ [https://perma.cc/4T3C-4JD4].
[8] The Impact of HAVA Funding on the 2018 Elections, U.S. ELECTION ASSISTANCE COMMISSION (2019), https://www.eac.gov/sites/default/files/paymentgrants/TheImpactofHAVAFundingonthe2018Elections_EAC.pdf [https://perma.cc/6KDW-RNEJ].
[9] Id.
[10] U.S Senate Committee on Rules and Administration Oversight of the Election Assistance Commission, U.S ELECTION ASSISTANCE COMMISSION (May 15, 2019), https://www.rules.senate.gov/imo/media/doc/EAC_Testimony.pdf [https://perma.cc/95VB-NA4H].
[11] Elizabeth Howard, Defending Elections: Federal Funding Needs for State Election Security, THE BRENNAN CENTER (July 18th, 2019), https://www.brennancenter.org/our-work/research-reports/defending-elections-federal-funding-needs-state-election-security [https://perma.cc/P7UC-8ZW4].
[12] Kevin Roose, The Only Safe Election is A Low-Tech Election, THE NEW YORK TIMES (Feb. 4, 2020), https://www.nytimes.com/2020/02/04/technology/election-tech.html, [https://perma.cc/2C8W-982G].
[13] Nick Corasaniti, Sheera Frenkel & Nicole Perlroth, App Used to Tabulate Votes is Said to Have Been Inadequately Tested, THE NEW YORK TIMES (Feb. 3, 2020), https://www.nytimes.com/2020/02/03/us/politics/iowa-caucus-app.html [https://perma.cc/B7TG-YJ2P].
[14] Keith Collins, Denise Lu & Charlie Smart, We Checked the Iowa Caucus Math. Here’s Where it Didn’t Add Up, THE NEW YORK TIMES (Feb. 14 2020), https://www.nytimes.com/interactive/2020/02/14/us/politics/iowa-caucus-results-mistakes.html [https://perma.cc/HH8N-DURV].
[15] S. 2669, 116th Cong. (2019); H.R. 1946, 116th Cong. (2019); H.R. 4990, 116th Cong. (2019).
[16] U.S. Election Assistance Commission, How Can The States Use the Funds?, U.S. ELECTION ASSISTANCE COMMISSION (Jan. 6, 2020) https://www.eac.gov/how-can-states-use-funds-0 [https://perma.cc/79W6-WHYA].
[17] H.R. 1158 § 501, 116th Cong. (2019).
[18] Lawrence Norden and Edgardo Cortez, What Does Election Security Cost?, THE BRENNAN CENTER (Aug. 15, 2019), https://www.brennancenter.org/our-work/analysis-opinion/what-does-election-security-cost [ https://perma.cc/TL69-YCU2].
[19] Howard, supra note 11.
[20] U.S. Senate Committee 116th Congress, Report of the Select Committee on Intelligence United States Senate on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election Volume 1: Russian Efforts Against Election Infrastructure With Additional Views, https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume1.pdf [https://perma.cc/CZ47-7XLY].
[21] Andy Greenberg, Feds’ Damning Report on Russian Election Hack Won’t Convince Skeptics, WIRED (Jan. 6, 2017), https://www.wired.com/2017/01/feds-damning-report-russian-election-hack-wont-convince-skeptics/ [https://perma.cc/2T8Q-YZR9].
[22] David E. Sanger and Catie Edmonson, Russia Targeted Election Systems in All 50 States, Report Finds, THE NEW YORK TIMES (July 25, 2019), https://www.nytimes.com/2019/07/25/us/politics/russian-hacking-elections.html [https://perma.cc/78SM-YVZ4].
[23] Andy Greenberg, Everything We Know About Russia’s Election-Hacking Playbook, WIRED (June 9, 2017), https://www.wired.com/story/russia-election-hacking-playbook/ [https://perma.cc/EAZ8-W5Z4].
[24] Shannon Bond, 2020 Political Campaigns Are Trying To Avoid A 2016-Style Hack, NAT’L PUB. RADIO (Jan. 28, 2020), https://www.npr.org/2020/01/28/799062773/2020-political-campaigns-are-trying-to-avoid-a-2016-style-hack [https://perma.cc/T2ER-KQ9U].
[25] Jeremey Ashkenas, Was It a 400-Pound, 14-Year-Old Hacker, or Russia? Here’s Some of the Evidence, THE NEW YORK TIMES (Jan. 26, 2017), https://www.nytimes.com/interactive/2017/01/06/us/russian-hack-evidence.html [https://perma.cc/U9CX-N829].
[26] Miles Parks, Russian Hackers Targeted The Most Vulnerable Part Of U.S. Elections Again, NAT’L PUB. RADIO (July 28, 2018), https://www.npr.org/2018/07/28/633056819/russian-hackers-targeted-the-most-vulnerable-part-of-u-s-elections-again [https://perma.cc/MR8E-3H3Q].
[27] Shannon Bond, Microsoft Says Iranians Tried To Hack U.S. Presidential Campaign, NAT’L PUB. RADIO(Oct. 4, 2019), https://www.npr.org/2019/10/04/767274042/microsoft-says-iranians-tried-to-hack-u-s-presidential-campaign [https://perma.cc/K9ST-T55N].
[28] Bond, supra note 24.
[29] Tom Burt, Protecting Democracy with Microsoft AccountGuard, MICROSOFT BLOG (August 20, 2018), https://blogs.microsoft.com/on-the-issues/2018/08/20/protecting-democracy-with-microsoft-accountguard/ [https://perma.cc/7MGY-MW5X].
[30] Lily Hay Newman, Google’s Giving Out Security Keys to Help Protect Campaigns, WIRED (Feb. 11, 2020), https://www.wired.com/story/google-free-security-keys-campaigns/ [https://perma.cc/4TN7-9SQ2].
[31] David Jefferson et al., What We Don’t Know About the Voatz “Blockchain” Internet Voting System (May 1, 2019), https://cse.sc.edu/~buell/blockchain papers/documents/WhatWeDontKnowAbouttheVoatz_Blockchain_.pdf [https://perma.cc/62H2-MQN4].
[32] Michael A. Specter et al., The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections, Mass. Inst. of Tech., https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf [https://perma.cc/89H7-XLP2].
[33] Abby Abazorius, MIT Researchers Identify Security Vulnerabilities in Voting App, MIT NEWS (Feb. 13, 2020), http://news.mit.edu/2020/voting-voatz-app-hack-issues-0213 [https://perma.cc/AA49-97FS].
[34] Robby Mook et al., Cybersecurity Campaign Playbook, HARV. KENNEDY SCHOOL BELFER CENTER (Nov. 2017), https://www.belfercenter.org/CyberPlaybook [https://perma.cc/82NN-KA57].
[35] Miles Parks, In 2020, Some Americans Will Vote On Their Phones. Is That The Future?, NAT’L PUB. RADIO (Nov 7, 2019), https://www.npr.org/2019/11/07/776403310/in-2020-some-americans-will-vote-on-their-phones-is-that-the-future [https://perma.cc/4W62-9TLS].
[36] Voatz, supra note 2.
[37] Jefferson et al., supra note 31.
[38] David Stone, West Virginia Was the First State to Use Mobile Voting. Should others follow? UCHICAGO NEWS (July 30, 2019), https://news.uchicago.edu/story/voting-mobile-devices-increases-election-turnout [https://perma.cc/NAF9-69B5].
[39] Anthony Fowler, Promises and Perils of Mobile Voting, U. OF CHI. (June 2019), https://cpb-us-w2.wpmucdn.com/web.sas.upenn.edu/dist/7/538/files/2019/06/Fowler_MobileVoting.pdf [https://perma.cc/6N8C-VQGZ].
