Experts sound alarms about security as states eye online voting

Experts are sounding alarms about potential security risks as several states consider allowing online voting amid the COVID-19 pandemic.

Delaware, New Jersey and West Virginia are planning to allow overseas military personnel and voters with disabilities to return their ballots electronically for elections this year amid concerns about voting during a pandemic. 

But federal officials and cybersecurity experts are strongly urging states to stay away from online voting, arguing that it could open up new avenues for interference less than four years after Russia meddled in the 2016 elections. 

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) joined a group of federal agencies in condemning the idea of online voting in guidelines first reported by The Guardian last week.

The guidelines, sent to states privately, described online voting as “high risk.”

“Electronic ballot return, the digital return of a voted ballot by the voter, creates significant security risks to voted ballot integrity, voter privacy, ballot secrecy, and system availability,” the agencies wrote in the guidelines. “Securing the return of voted ballots via the internet while maintaining voter privacy is difficult, if not impossible, at this time.”

The National Academies of Science, Engineering, and Medicine has also warned against electronic voting, and members of Congress have railed against the practice, citing security concerns. 

Rep. Jim Langevin (D-R.I.), the former chairman of the House Homeland Security Committee’s cyber panel, expressed his support for the federal guidelines, warning that Russia or other state actors could see online voting as a tempting way to interfere in U.S. elections. 

“As experts have stated unequivocally for years, Internet voting is not secure,” Langevin said in a tweeted statement late last week. “The guidance echoes this assessment, making clear that electronic ballot return, as opposed to mailing returns, risks compromising the integrity of our voting process. 

Sen. Ron Wyden (D-Ore.) described the practice as “snake oil” this week. 

“Cybersecurity experts are sounding the alarm: internet voting will leave our elections vulnerable. Companies selling this technology with the promise of peace of mind are nothing more than snake oil salesmen,” Wyden tweeted Monday. “#VoteByMail is the safest way to vote during a pandemic. Full stop.”

Russian state-backed actors targeted U.S. election infrastructure, including voter registration systems, in all 50 states in the run-up to the 2016 presidential election, according to the Intelligence Community (IC) and former special counsel Robert Mueller.

In February, reports emerged that IC officials had told the House Intelligence Committee that Russia was again attempting to interfere in the 2020 presidential election. 

But despite concerns around the ability of foreign actors to target online systems, some states are forging ahead with limited electronic voting, while highlighting the security controls in place. 

A spokesperson for Delaware State Election Commissioner Anthony Albence told The Hill last month that the system the state intended to use was not “internet or online voting,” but instead provided a way “for a voter to electronically receive and mark their ballot in a secure environment.”

West Virginia Secretary of State Mac Warner (R) has heralded his state’s online voting system as ensuring some voters are not disenfranchised, including those living overseas.

“West Virginians — military, diplomats, college students, professors — in 31 countries voted electronically in 2018,” Warner wrote in an op-ed for The State Journal. “Today, 161 of the 195 countries in the world do not have U.S. Postal Service due to coronavirus concerns. If it weren’t for our e-voting, West Virginia citizens in those countries would be disenfranchised in the 2020 elections.” 

West Virginia elections have been under the microscope since findings by a team of researchers at the Massachusetts Institute of Technology came to light showing that the “Voatz” app used for electronic voting in 2018 had a multitude of cyber vulnerabilities. 

The state subsequently announced it would no longer use the app, and has switched over to using tools from Seattle-based company Democracy Live.

Democracy Live, founded in 2007 and used by the Department of Defense to assist overseas troops with voting, will be used by Delaware and New Jersey in upcoming elections as well. 

The system involves an eligible voter being emailed directions for voting through Democracy Live’s cloud portal, hosted by Amazon Web Services, with voters then able to submit the ballot electronically or mail it back. State officials then print out the ballot. 

Democracy Live President Bryan Finney told The Hill on Tuesday that the company’s OmniBallot system was meant to help the blind and disabled to vote. 

“The OmniBallot system has been deployed as a secure ballot delivery system for over a decade, serving military, overseas and voters with disabilities in over 1,000 elections,” Finney said. “We look forward to collaborating with all experts to continue to extend access to voting to all voters who may currently be disenfranchised.”

But election security experts have warned that despite the need for disabled voters to have access to the polls, there is no guarantee that online or electronic voting is secure. 

Election Assistance Commission Chairman Ben Hovland, who was appointed by President Trump, told The Hill last month that there are “real risks” involved with electronic voting. 

“We’ve seen some progress in this space, but generally I think the consensus of scientists in this space is, we don’t yet have a system that is ready for mass usage,” Hovland said. 

Lawrence Norden, the director of the Election Reform Program at New York University’s Brennan Center for Justice, was skeptical of testing online voting options during the COVID-19 pandemic. 

“There couldn’t be a worse time to try this when there is so much change happening in our elections because of COVID-19,” Norden told The Hill. “To layer on top of that the complexity and security challenges of allowing people to vote over the internet is too high a security risk at this time.”

Norden encouraged Congress to send states more election funds to stop states from moving to online voting as a cheaper alternative to mail-in ballots, a funding effort House Democrats got behind this week. 

“States and localities are going to be desperate for silver bullets like internet voting if they don’t get the funding they need for elections this year,” Norden said. “Congress needs to get them the support that they need to conduct safe and secure elections.”