Despite security concerns, online voting is happening in 2020

Editor’s note: This story aired on The World on Feb. 6. In a paper released Feb. 13, MIT researchers said they discovered the Voatz app is riddled with vulnerabilities, including ones that would “allow different kinds of adversaries to alter, stop, or expose a user’s vote.” Mason County, Washington, featured in our story here, has pulled out from using the Voatz app. To learn more about the recent developments, check out our story that aired on The World on Feb. 13. 

Paddy McGuire knows all about the unique challenges US military members face when they try to vote. For several years, McGuire worked for the Federal Voting Assistance Program in the Department of Defense, where his job was to make the voting experience easier for military and overseas voters, many of whom are stationed in remote areas without consistent access to postal mail and other services needed to cast their ballots.

“The vast, vast majority of service members that I met when I was working for the DoD — their first question was, ‘Why can’t I vote on my phone?’” McGuire said.

Related: Washington state expands online voting for military and overseas voters

Overseas and military voters registered in Mason County, Washington, where McGuire is currently the chief elections official, are able to do just that in the March 2020 presidential preference primary. Eligible voters — there are approximately 500 overseas and military voters registered in Mason County — can cast ballots through their smartphones using an app created by the Boston-based mobile voting company Voatz.

“We are brand new at it,” McGuire said of mobile voting last week, adding that he became aware of the Voatz app after neighboring Pierce County made it available to its 19,000 overseas and military voters during a pilot in 2019.

“We have overseas voters that live in places where there is not a working postal service,” McGuire said. “It’s just a fact. And so, returning ballots by mail isn’t an option.” Washington, along with several other states, also allows voters who fall under The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) to return ballots electronically via fax or email. The Voatz app, McGuire said, offers an additional and a more secure electronic ballot return option.

Jurisdictions in several other states, including Utah and Oregon, are also making mobile voting through the Voatz app available for the primaries and, at least in the case of Utah County, Utah, the November 2020 presidential election.

Election officials say the goal of these initiatives is to make the voting process easier and the ballot box more accessible to overseas and military voters who face unique obstacles when they try to vote.

But experts say evidence suggests internet voting doesn’t necessarily increase voter participation and that it introduces unnecessary security risks to an already vulnerable process. Also, they’ve sounded the alarm over Voatz in particular, saying the company has resisted numerous calls to share details about its software and third-party security audits of its systems.

Founded in 2015, Voatz describes itself as being “on a mission to make voting safer and more accessible.” The company occupies a small office in a co-working space in downtown Boston and has approximately 22 employees.

Related: Facebook content moderators sue over psychological trauma

Voatz co-founder and CEO, Nimit Sawhney, says technology can help boost voter turn-out in the US which, by international standards, is low. In 2016, only 56% of voting-age Americans cast ballots in the presidential election.

“My biggest fear is a few election cycles from now, less than a third of the country’s voting.”

“My biggest fear is a few election cycles from now, less than a third of the country’s voting,” Sawhney said. “It’s not easy for everybody to vote. And so, if technology is available and we can show that it’s safe enough, why not make it easier for people to vote?”

But is it safe enough? Election security experts say it’s not, and they’ve warned for years that we don’t have the technology to securely do online voting of any kind.

“Venturing into the internet does increase the risk in a way that can’t adequately be protected at this juncture, given the state of technology,” said Marian Schneider, president of Verified Voting, a nonpartisan organization that promotes the responsible use of technology in elections.

In its 2018 report, “Securing the Vote: Protecting American Democracy,” the National Academies of Sciences, Engineering, and Medicine warned that “currently, no known technology can guarantee the secrecy, security, and verifiability of a marked ballot transmitted over the Internet.”

The Senate Intelligence Committee warned in its 2019 bipartisan report on Russian interference in the 2016 election, that states should “resist pushes” for online voting. “One main argument for voting online is to allow members of the military easier access to their fundamental right to vote while deployed. While the committee agrees states should take great pains to ensure members of the military get to vote for their elected officials, no system of online voting has yet to establish itself as secure,” the report read.

Related: TikTok apologizes to US teen after removing video critical of Chinese government

“In 2020, it should be common sense that you want to keep voting systems as far from the internet as possible,” said J. Alex Halderman, a professor of computer science and engineering at the University of Michigan who works on election security issues. “We [saw] real attacks against election infrastructure in 2016, targeting perhaps all 50 states. So, it sounds crazy that you would want to be casting and transmitting votes over the internet.”

Voting securely online, Halderman and other experts say, requires solving some of the most challenging problems in computer security.

“You have to remotely authenticate people to make sure they are who they say they are,” Halderman said. “You have to secure the voter device, their phone or computer, from malware. You have to secure the servers [that hold voter and ballot information] from some of the world’s most sophisticated adversaries, like hostile foreign nations.”

“All of these things are extremely hard challenges that we haven’t solved, in general. And there is no reason to believe that a small startup like Voatz suddenly has the magic solution to all of these issues.” 

“All of these things are extremely hard challenges that we haven’t solved, in general. And there is no reason to believe that a small startup like Voatz suddenly has the magic solution to all of these issues,” Halderman said.

Sawhney, Voatz’s co-founder and CEO, says he and his team are constantly thinking about the security of their mobile voting app. “Security is never permanent,” Sawhney said. “What’s secure today could be easily, not secure tomorrow. So, it’s a 24/7 battle. And the people who want to disrupt the elections are very motivated, sometimes very well-funded — way more than we are. And so, that’s definitely something we worry about a lot.”

But he said that warnings against online voting of any kind overlooks recent technology advancements, including in biometric authentication and blockchain encryption technology, which Voatz is using to authenticate voters’ identities, and to store and transmit ballots securely.

Voatz says its systems have undergone extensive security testing and that the company has voluntarily worked with several third-party security firms, as well as the Department of Homeland Security, to do security audits of their apps and systems. But none of the subsequent reports, nor any of their findings, have been made public.

“If they were so foolproof, I think Voatz would have released their security reports to independent security experts for review.”

“If they were so foolproof, I think Voatz would have released their security reports to independent security experts for review,” said Schneider, with Verified Voting.

Critics say Voatz has also rejected calls to share its source code, or a detailed technical description of its product, with security researchers who want to vet it, citing concerns over proprietary information.

“The proprietary source code model, I think, is an outdated model,” said Bryan Finney, founder and President of Democracy Live, a Seattle-based company providing an app and online portal being used by overseas and military voters in Pierce County, Washington, to cast ballots in the primary. “We would welcome and we would love to engage with qualified researchers … to have a full vetting.”

Experts say this kind of independent, technical vetting is crucial, and several pointed to Switzerland as proof. The county was recently close to deploying an online voting system. “But they did make it open source and [let] cryptographers examine it,” Halderman said. “And what happened was the cryptographers found extremely serious vulnerabilities. And as a result of that, Switzerland ended up not using the system. But in order to find those specific problems, the expert community needed the details of the system’s operation.”

Experts have also pointed to the IowaReporterApp debacle to stress the importance of transparency and independent vetting of apps — especially ones being used in the elections. An app commissioned by the Iowa Democratic Party to tally and report results from the caucuses last week failed — spectacularly — significantly delaying results of the caucuses and creating an opening for misinformation and conspiracy theories to spread online. In the lead-up to the Iowa caucuses, the state’s Democractic Party insisted the app was secure, but it did not disclose who created it or what security vetting it had gone through. A review of the app by ProPublica after the caucuses found that the app “lack[ed] key safeguards.”

Voatz says it’s committed to providing as much transparency as possible about its system and points to its bug bounty program through which white-hat hackers and researchers can report vulnerabilities as proof. But the company has a long way to go to convince lawmakers and the research community that its product is, in fact, secure.

Just last week, Democratic Sen. Ron Wyden sent a letter to election officials in his home state, urging them to reconsider using the Voatz app and other electronic ballot return options. “Continuing to permit the use of internet voting — against the advice of cybersecurity experts — is simply asking for trouble,” Wyden wrote in the letter, first obtained by The Washington Post.

As for the officials running elections in the jurisdictions where Voatz app and other online solutions will be used? They say they’re satisfied with the assurances they’ve gotten from Voatz and other companies, and that even if there are risks involved, the apps provide a better and more secure alternative to other electronic ballot returns some states offer to overseas and military voters: fax and email.

“It is at least conceivably possible that the email coming back to us [with a ballot return attachment] could be intercepted and the attachment altered and … we would not have the ability to know that that happened,” said McGuire, the election chief in Mason County.

Related: As 2020 US presidential election nears, voter systems are still vulnerable

The Voatz app, according to McGuire, offers a more secure option that also allows for greater voter anonymity.

“This may not be absolutely the perfect solution. But it’s progress,” McGuire said. “And I think we can either bury our heads in the sand and say, ‘Too bad those folks shouldn’t be able to choose their commander in chief’ or … we’re going to do everything we can to let them vote.”