Posts Tagged


MIT researchers say mobile voting app piloted in U.S. is rife with vulnerabilities

Elections officials in numerous states have piloted various mobile voting applications as a method of expanding access to the polls, but MIT researchers say one of the more popular apps has security vulnerabilities that could open it up to tampering by bad actors.

The MIT analysis of the application, called Voatz, highlighted a number of weaknesses that could allow hackers to “alter, stop, or expose how an individual user has voted.”

Additionally, the researchers found that Voatz’s use of Palo Alto-based vendor Jumio for voter identification and verification poses potential privacy issues for users.

The study comes on the heels this month’s trouble-plagued Iowa Democratic Presidential Caucus, which used an online app to store votes but failed to do so accurately because of a coding flaw and insufficient testing.

Some security experts have long argued that the only secure form of voting is paper ballots.

iPhone iOS voatz blockchain voting Voatz

Voatz iPhone mobile voting application.

The Voatz mobile voting application has been used in small pilots involving  only about 600 voters total in Denver, West Virginia, five counties in Oregon, Utah and Washington State, where the main focus was on inclusivity for absentee voters living overseas.

In response, Voatz called the MIT report “flawed” because it based its analysis on a long-outdated Android version of the app.

“Had the researchers taken the time, like nearly 100 other researchers, to test and verify their claims using the latest version of our platform via our public bug bounty program on HackerOne, they would not have ended up producing a report that asserts claims on the basis of an erroneous method,” Voatz stated in a blog post today.

“We want to be clear that all nine of our governmental pilot elections conducted to date, involving less than 600 voters, have been conducted safely and securely with no reported issues,” Voatz said.

In 2018, West Virginia piloted Voatz’s mobile voting app for resident service members and family living overseas who wanted to vote in the midterm general election. 

West Virginia Secretary of State’s office pointed to a Department of Homeland Security security assessment of the 2018 Voatz pilots indicating there was “no threat actor behaviors or artifacts of past nefarious activities were detected in the vendor’s networks.”

Audits of paper ballots created by the Voatz plaform on election day also confirmed the results were accurate, according to the Secretary of State’s office.

“We want to get the word out to media outlets like Computerworld to ensure WV voters that we are taking every possible precaution to balance election security and integrity with WV requirement to provide absentee ballots electronically to overseas, military and absentee voters living with physical disabilities,” Mike Queen, deputy chief of staff for West Virginia Secretary of State Mac Warner, said via email.

The MIT study, however, underscored the need for Voatz’s mobile app design to be more transparent because public information about the technology is “vague” at best.

Voatz’s platform uses a combination of biometrics, such as mobile-phone based facial recognition, and hardware-backed keystores to provide end-to-end encrypted and voter-verifiable ballots. It also uses blockchain as an immutable electronic ledger to store voting results.

Voatz has declined to provide formal details about its platform, citing the need to protect intellectual property, the researchers said in their paper.

In a blog post today, Voatz called the researchers’ approach “flawed,” which “invalidates any claims about their ability to compromise the overall system.

“In short, to make claims about a backend server without any evidence or connection to the server negates any degree of credibility on behalf of the researchers,” Voatz said.

The researchers also called Voatz out for reporting a University of Michigan researcher who in 2018 conducted an analysis of the Voatz app. “This resulted in the FBI conducting an investigation against the researcher,” the MIT researchers said.

It’s not the first time Voatz has been criticized for not being more open about its technology. Last May, computer scientists from Lawrence Livermore National Laboratory and the University of South Carolina, along with election oversight groups, published a paper that criticized Voatz for not releasing any “detailed technical description” of its technology.

“There are at least four companies attempting to offer internet or mobile voting solutions for high-stakes elections, and one 2020 Democratic presidential candidate has included voting from a mobile device via the blockchain in his policy plank,” the MIT researchers said in their paper. “To our knowledge, only Voatz has successfully fielded such a system.”

Along with Voatz, Democracy Live, VotemSecureVote and Scytl have all piloted mobile or online voting technology in various public or private balloting that included company stockholder and college board elections. Most recently, a Seattle district piloted the Democracy Live technology in a board of supervisors election that was open to 1.2 million registered voters.

Tusk Philanthropies, a nonprofit focused on promoting mobile voting as a way to increase voter turnout, has helped fund and promote Voatz and Democracy Live.

In a statement to Computerworld, Tusk said it feels confident in the results of all the pilot elections because it conducted independent, third-party audits “which showed that votes cast over the blockchain were recorded and tabulated accurately.”

“With that being said, we always welcome new security information and will work with security experts to review this paper,” Tusk said. “Security is an iterative process that can only get better over time. There is no room for error in our elections, especially when it comes to data leakage, compromised encryption, broken authentication, or denial-of-service attacks.”

Medici Ventures, the wholly-owned investment subsidiary of, has also backed Voatz, whose application has mainly been used to allow absentee voter service members and their families to cast their ballots via their smartphones from anywhere in the world.

Jonathan Johnson, CEO of Overstock and president of Medici Ventures, responded in a statement to a New York Times article about the MIT study, saying he believes the Voatz technology is responsible and safe.

“It not only prevents voting fraud, but it also protects the privacy of each voter. The Voatz app even generates a paper ballot that can be audited to guarantee the fidelity of the vote,” Johnson said. “This is, we believe, the right path forward to safe innovation in election technology. We should not let ourselves derail the future of voting.”

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions — all associated with infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots.

Jeremy Epstein, vice chair of the Association for Computing Machinery’s US Technology Policy Committee (USTPC), has been a vocal critic of mobile voting platforms, including Voatz. He said the MIT study was “very thorough” and demonstrates exactly what experts have been saying for years.

“Internet voting is risky. It’s no surprise that the Voatz system is vulnerable to many kinds of attacks, even to an attacker with no access to source code or other inside information,” Epstein said via email. “The attacks demonstrated by MIT are well within the capabilities of nation-state adversaries who are interested in manipulating US elections, and such an adversary won’t publish their results as the MIT team has done, leaving us with an election that may be undetectably manipulated.”

The five-year-old Voatz slammed the MIT researchers for never connecting even the outdated app they used to the company’s servers, which are hosted by Amazon AWS and Microsoft Azure.

In the absence of connecting to the actual servers recording public votes, “the researchers fabricated an imagined version of the Voatz servers, hypothesized how they worked, and then made assumptions about the interactions between the system components that are simply false,” Voatz said.

Epstein retorted that Voatz’s comments “demonstrate that they don’t understand either the severity of the attacks or the way security works in general.

“Any election official using Voatz products would be well advised to cancel their plans, before a stealthy attack in a real election compromises democracy,” Epstein said.

Copyright © 2020 IDG Communications, Inc.

Source link

Iowa Caucus chaos likely to set back mobile voting

A coding flaw and lack of sufficient testing of an application to record votes in Monday’s Iowa Democratic Presidential Caucus will likely hurt the advancement and uptake of online voting.

While there have been hundreds of tests of mobile and online voting platforms in recent years – mostly in small municipal or corporate shareholder and university student elections – online voting technology has yet to be tested for widespread use by the general public in a national election.

“This is one of the cases where we narrowly dodged a bullet,” said Jeremy Epstein, vice chair of the Association for Computing Machinery’s US Technology Policy Committee (USTPC). “The Iowa Democratic Party had planned to allow voters to vote in the caucus using their phones; if this sort of meltdown had happened with actual votes, it would have been an actual disaster. In this case, it’s just delayed results and egg on the face of the people who built and purchased the technology.”

The vote tallying app used yesterday in the Iowa Caucus was created by a small Washington-based vendor called Shadow Inc.; the app was funded in part by a nonprofit progressive digital strategy firm named Acronym. Today, Acronyn strived to make it clear through a tweet it did not supply the technology for the Iowa Caucus, and it is no more than an investor.

Last year, the Iowa Democratic Party (IDP) paid Shadow Inc. more than $60,000 for a website that was to upload caucus results, which it failed to accurately do yesterday. The problem with Shadow’s app was blamed on “a coding error” that has since been fixed, the IDP said in a statement. Results from the caucus were due out later today, according to the IDP.

The IDP said it determined “with certainty” that the underlying data collected using the app is accurate and sound, but was only reported out partially.

“We have every indication that our systems were secure and there was not a cybersecurity intrusion. In preparation for the caucuses, our systems were tested by independent cybersecurity consultants,” Iowa Democratic Party chairman Troy Price said in the statement.

Shadow Inc. apologized for the malfunction in a series of tweets.

The Nevada Democratic Party, which had planned on using Shadow’s app, said in a statement today they’re abandoning it.

As the desire to increase voter turnout remains strong and the number of online voting pilot projects grows in the U.S. and abroad, some security experts warn that any internet-based election system is wide open to attack, regardless of the underlying infrastructure.

“It’s yet another nail in the coffin of internet voting. If a vendor can’t get a relatively simple app like this right, what’re the odds that they can get a much more complicated voting system right?” Epstein said. “Voting systems require accurate identification of voters and maintenance of secret ballots, all while protecting against malware in voters’ phones and attacks against servers – and all this system needed to do was capture a few values and send them to a server, which had to be protected from attacks. I hope that folks who were responsible for selection of this app will learn a lesson.”

Others believe the blowback from the Iowa Caucus debacle will dissipate if “a good app were to surface” and can be used to vote in an effective manner, according Jack Gold, principal analyst for J.Gold Associates.

“I have to believe that this was never tested in a real-world scenario before the use in the caucuses, otherwise they would have known of the flaws in the app,” Gold said. “Was it rushed? Did they not go to a competent app creator? Did they spec the app incorrectly? Did the user interface actually work? There are lots of questions that need to be answered about this.

“Will this have a long-term negative effect? Probably. The publicity around this will put some doubt into the public trust of mobile voting.”

While mobile or online voting applications hold the promise of opening up the polls to absentee voters and making voting more accessible in genral, security concerns have been at the forefront of election officials since Russia’s interference in the 2016 presidential contest.

Tusk Philanthropies, a non-profit organization that promotes mobile voting and has funded past projects enabled by two vendor platforms, reacted to an IDG video about online voting today saying its vendors’ technology has been tested and successfully used in hundreds of elections.

“From what we know, the app used in the IA Democratic Caucuses was brand new, untested and created in secrecy,” a Tusk Philanthropies spokeswoman wrote via email. “This couldn’t be in more stark contrast to the eight pilots we have completed transparently, safely and securely.”

Tusk Philanthropies has been a proponent of mobile voting apps from Voatz and Democracy Live, which is currently being used in the election of a board of supervisors in the Seattle area.

Tusk Philanthropies wanted to “make clear” Shadow Inc.’s app is not “indeed a mobile voting option or app.

“There will be lots of calls to go back to paper ballots today, but we cannot forget that paper ballots brought us hanging chads and the Iraq War. Or that unsecure voting machines are also vulnerable to hacking,” a Tusk Philanthropies’ spokesperson said. “We need to stop relying on outdated approaches to voting like caucusing in gyms or having people congregate around a bunch of voting machines in a school basement.”

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions — all associated with infecting voters’ computers with malware or infecting the computers in the elections offices that handle and count ballots.

The problem with online voting isn’t that it’s more or less secure than current polling systems; it’s more about public perception and how that may affect turnout, according to Julie Wise, elections director for Seattle’s King County.

“I don’t think they’re ready for it,” Wise said in an interview last week. “Critically important to running elections as an administrator is having voter confidence and trust in the electoral system. There’s understandable concern around election security and hacking of anything on the internet whatsoever.”

Atif Ghauri, cybersecurity practice leader and principal at global consulting firm Mazars USA, said the ubiquity of mobile devices has created a massive new frontier for cyber threats to mobile apps from Shadow Inc. and any other mobile app providers.

“The public’s concern is certainly warranted, as mobile apps not only expose software threats, but also location-based threats based on where the device is physically located. Knowing specific GPS coordinates adds another dimension to the attack,” Ghauri said via email. “The use of mobile devices by the less tech-savvy or aware also increases the likelihood of an attack.”

There are strategies mobile voting vendors and public officials can take to alleviate public concerns. First and foremost, Ghauri said, is the use of multi-factor authentication to provide a biometric, such as facial or finger print recognition, and a passcode from the user – all of which reduce the possibility of security threats. The use of a blockchain ledger for transactions will help substantially with transaction integrity, Ghauri said.

There are a small number of mobile voting platforms, including Democacy Live, VoatzVotemSecureVote and Scytl.

Voatz’s mobile application uses blockchain as an immutable electronic ledger to record voting results.

In a blog, Voatz said it had never heard of Showdow Inc. or its technology and was quick to distant itself from the Iowa caucus.

“And using an app to tabulate in-person caucus votes is not mobile voting,” the company argued. “Voatz is a mobile elections platform built to ensure an accessible, secure voting method for groups that otherwise face difficulties with the voting options currently available (i.e. overseas citizens, deployed military, and voters with disabilities). We’ve been in the industry for [five] years and have run more than 50 safe and secure elections.”

Voatz said it works with the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA), and other independent third parties for security testing and infrastructure analysis of its app.

Democracy Live’s OmniBallot web portal does not use blockchain as the basis for collecting and securing electronic ballots. Instead, it uses Amazon Web Services’ (AWS) Object Lock, which is NIST compliant and has FedRamp certification, a government program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud services.

The OmniBallot portal has been deployed in more than 1,000 elections across the U.S. and used by 15 million voters in hundreds of jurisdictions since 2008, according to the company.

“The bottom line is, if you are going to deploy a mission-critical mobile app, especially one with this public visibility, you better test the heck out of it and make sure it works as expected, and under full load (not just on someone’s smartphone in the office),” Gold said.

Copyright © 2020 IDG Communications, Inc.

Source link

Seattle tries out mobile voting

About 1.2 million Seattle area voters will be able to use their smartphone, laptop or a computer at their local library to vote in a current election this year.

This will be the first-time online voting is available to all eligible registered voters of a district, according to a foundation behind the initiative.

The King Conservation District in Washington State is the third region in the U.S. to partner with the non-profit Tusk Philanthropies on a national effort to expand mobile voting, and Washington is the fifth state to pilot mobile voting in general. The King Conservation District is a state environmental agency that includes Seattle and 33 other cities, but it is separate from the King County Elections agency and operates under a different budget.

The King Conservation District has struggled to spur voter turnout in past elections. Last year’s Board of Supervisors’ election was among its highest ever with a turnout of just 0.2%, or 3,000 voters out of a possible 1.22 million registered to vote, according to Julia Wise, director of elections for King County.

Seattle’s King Conservation District began accepting electronic ballots on Jan. 22 for three of five supervisor seats; it will continue to accept them through Feb. 11.

For the past decade, Washington State has allowed all of its voters to access ballots electronically, but only for the purposes of printing out and then mailing them in. For the first time, the King Conservation District election is allowing voters to access ballots and submit their votes online via Amazon’s cloud service.

“It’s not technology I’ll be rolling out for King County in upcoming elections,” said Julia Wise, King County Elections director. “The Conservation District in Washington State has struggled to reach out to its voters. This district doesn’t have the money to get a ballot into the mail for 1.22 million registered voters, so they’re trying to find a creative way to get voters access.”

General elections in King County have had no problems garnering voter turnout, according to Wise, whose office has a vastly larger budget than the Conservation District’s. In past presidential elections, King County saw 80% voter turnout.

While Wise has no plans to roll out internet-based voting for Seattle’s general populace, she said she’s “watching” the Conservation District’s election closely and has used the same technology for absentee voters living overseas – though those voters emailed the ballots as attachments.

The problem with online voting, Wise said, isn’t that it’s more or less secure; it’s more about public perception and how that may affect turnout.

“I don’t think they’re ready for it,” she said. “Critically important to running elections as an administrator is having voter confidence and trust in the electoral system. There’s understandable concern around election security and hacking of anything on the internet whatsoever. So, I think this is a great test that I’m very interested in and will continue to watch, but part that test is about voter behavior. We see there’s a lot of voters concerned about this method and I wouldn’t implement any method that I’d be concerned about taking [away voter turnout].”

“Democracy is always at its finest when… all voices are heard. Voter trust is too important to risk in our King County elections at this time,” Wise continued. “I still applaud the [Conservation District] for getting creative with a small budget.”

Security concerns

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions – all associated with infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots.

Jeremy Epstein, vice chairman of the Association for Computing Machinery’s U.S. Technology Policy Committee, said Seattle’s “experiment is very ill-advised,” and voters who use it are hoping that the software correctly records their vote, though  “there’s no way to ensure that’s the case.

“They’re hoping the software doesn’t disclose their vote to anyone else; there’s no way to ensure that’s the case either,” Epsein said via email. “They’re hoping that the servers don’t get hacked which could change their votes – yet again, no way to ensure that’s the case. There’s been no independent security assessment of the system – just the vendor’s assertions that their system is secure. And what we know from 20-plus  years of web applications is that there is always a way to break in, and it’s usually not hard.”

Adding to an innate insecurity of online and mobile voting systems is that compromises often aren’t discovered for months after they happen, long after the election results are finalized and it’s too late to do anything.

mobile ballot omniballot Democracy Live

Democracy Live’s OmniBallot mobile interface.

“If I were a betting man (which I’m not), I’d put my money on the nickel slots before I relied on the security of a system like this to record votes. At least with nickel slots you’ve got some chance of not losing everything,” Epstein said. “For now, mail-in paper ballots are the only safe choice.”

Michela Menting, digital security & blockchain research director at ABI Research, said mobile voting is becoming mature enough to be used in the general voting process, and there will be increasing opportunities to allow for tech-based voting, whether it is mobile or blockchain-based.

“The security concerns associated with voting can be alleviated through technology, there is no doubt, especially when this is properly implemented,” Menting said.

The technology behind the Conservation District’s supervisors’ election is funded by Tusk Philanthropies, a non-profit focused on promoting mobile voting as a way to increase voter turnout. The technology for the online voting platform is being provided by vendor Democracy Live, a company founded in 2007.

Democracy Live is among a small number of mobile voting platforms that includes  VoatzVotemSecureVote and Scytl, all of which have piloted their technology in various public or private balloting that included company stockholder and college board elections.

“It’s the biggest innovation in democracy in years and we are extremely grateful to King Conservation District and King County Elections for making it happen,” Bradley Tusk, CEO and founder of Tusk Philanthropies, said in a blog post.

Tusk Philanthropies has also funded mobile voting efforts in Utah and Denver, both of which used technology from Voatz, whose platform uses blockchain as well as AWS and Microsoft’s Azure cloud services to record ballots. West Virginia has also piloted mobile voting using Voatz’s platform.

Computerworld > Mobile voting via Voatz phone app Voatz / blackdovfx / Getty Images

Voatz’s mobile voting user interface.

Past mobile voting initiatives, however, have mainly been aimed at absentee voters, such as military and their families residing overseas. Seattle’s current mobile voting pilot is aimed squarely at the U.S.-based voter population.

How it works

Seattle area voters can log into the secure Democracy Live’s OmniBallot portal on their smart devices using their name and date of birth to access and mark their ballot. Once a voter has made their selections, he or she will has the opportunity to review the  ballot to ensure it was marked correctly.

Upon confirming their selections, a voter will submit their signature to verify their submission before electronically returning their ballot. Voters will also have the option to print and return their marked ballots via local drop boxes throughout the county, or to mail in their ballot. Ballots will be verified and tabulated by King County Elections.

Unlike some other mobile voting platforms, Democracy Live’s does not use blockchain as the basis for collecting and securing electronic ballots. Instead, it uses Amazon Web Services’ (AWS) Object lock, which is NIST compliant and has FedRamp certification, a government program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud services.

“Of course, this does not mean that the solution is 100% secure, but it provides one of the highest levels of security available today for protecting ballot information,” Menting said via email. “While it is not necessarily more (or less) secure than traditional paper-based voting, it is certainly more cost-effective and time efficient, and has the advantage of being able to reach those eligible to vote that are overseas or disabled.”

Democracy Live said it developed its OmniBallot platform to be a fully accessible, ADA-compliant secure balloting portal available to each of the 200 million voters in the U.S.

The OmniBallot portal has been deployed in more than 1,000 elections across the U.S, serving some 15 million voters in hundreds of jurisdictions since 2008, according to the company.

“Security and accessibility are the key reason Democracy Live is excited to participate in this pilot. Outside of Washington State, most overseas and military voters’ email or fax ballots, which may be the least secure method of transmitting critical documents such as ballots,” said Bryan Finney, CEO and Founder of Democracy Live. “Voters with disabilities often cannot vote independently at home because they cannot see, mark or hold the ballot. This pilot is an effort to show how all voters, including voters with disabilities and remote voters.”

The voting technology behind Democracy Live is different from that of mobile voting vendors who use blockchain to store ballots submitted by voters.

While blockchain provides “de facto immutability,” a cloud service like Amazon’s or Microsoft’s needs to go a step further to prove that it cannot be altered, according to Menting.

“But neither is inherently more secure than another; cloud just has an additional barrier to overcome security-wise, which Democracy Live seems to have successfully tackled,” Menting said. “I believe that such technologies, whether blockchain or mobile, will continue to emerge as highly capable and suitable technologies for voting going forward.”

Copyright © 2020 IDG Communications, Inc.

Source link

Pros and Cons vs. Paper Voting

In a world where your kettle can be connected to the internet, why is voting still done on paper? While voting from the comfort of your own home seems appealing, there are electronic voting pros and cons that have to be considered first.

Let’s take a look at what electronic voting is and if it can replace paper voting.

What Is Electronic Voting?

When you imagine how electronic voting works, you may picture tapping a touchscreen at an electronic voting machine (EVM) or casting your vote online. However, the term “electronic voting” covers much more than this.

Electronic voting involves any form of voting that uses modern technology to either cast or tally votes. Many polling locations in the United States have already made the switch by using scanner machines to count paper ballots.

So, why do we bother walking to the polling booth when we could just vote online? There are many advantages and disadvantages to electronic voting that need consideration before we use it to define a country’s future.

The Advantages of Electronic Voting

Someone using an electronic voting machine
Image Credit: lisafx/DepositPhotos

With the technology we have at our fingertips, it’s possible to set up a voting system for an entire country. There are several advantages of electronic voting that make voting easier than ever before.

Results Come in Faster With Electronic Voting

The primary advantage of an electronic voting machine is its speed. With traditional paper methods, ballots must be collected and counted from polling stations. This process is time-consuming and delays the final result.

In the United States, this delay typically keeps viewers up all night. With electronic voting, results are available almost instantly because votes are counted as they are cast. To calculate the final result, all the polling stations report their votes and they’re all added together. By using e-voting, the results of elections could be available in a matter of hours rather than days, meaning elections could have a more instantaneous impact.

Internet Voting Can Increase Attendance

Another major plus of electronic voting is voter engagement. Many people fail to take advantage of their right to elect their officials, even when Google begs them to vote

Google Really, Really, Really Wants You to Vote

Google Really, Really, Really Wants You to Vote

America is finally set to choose the next President of the United States. Regardless of who you’re voting for, it’s important to just vote. At least according to Google.
Read More

. Advocates for e-voting argue that by offering an option to vote from home or work, more people would cast their votes.

Electronic voting also allows for greater accessibility to people with disabilities. Currently, someone unable to mark paper ballots requires an assistant to vote for them. This process compromises the person’s right to cast an anonymous ballot.

By bringing voting into the digital space, people who are unable to visit or use a polling booth can vote from home. This maintains anonymity and encourages the disabled and elderly to make their voices heard.

Electronic Voting Is More Cost-Effective in the Long Run

Finally, the last major advantage associated with e-voting is a long-term decrease in expenses. Paper votes require assistants that count and transport votes, which can add up as stations around the country tally up the results. These expenses could put a major strain on an entity like a small, underfunded local government.

Electronic ballot-counting machines can cut the cost of human counters, while internet voting can also cut out polling location employees. The infrastructure can be re-used every election, so it would be a one-time purchase.

The Disadvantages of Electronic Voting

A hacker manipulating votes
Image Credit: BeeBright/DepositPhotos

Right now, the case for electronic voting seems strong. However, there are disadvantages to electronic voting that must be considered. While voting over the internet may seem convenient and easy, swapping to electronic voting may compromise the integrity of the political system.

Hackers Can Compromise Electronic Voting

By far, the biggest disadvantage of an electronic voting machine is election hacking

How Does Election Hacking Work? Everything Explained in Simple Terms

How Does Election Hacking Work? Everything Explained in Simple Terms

Wondering what election hacking actually means and involves? We’ll explain it in a straightforward way.
Read More

. As with any electronic device, there is always the risk that someone could illegally alter the results of an election.

This could be done either through physical tampering or a remote attack over the internet. Allowing people to vote using their own devices could pose major risks as well. A malicious agent could change millions of electronic votes undetected. Changing that many paper ballots would be impossible not to notice.

Fraud Is Easier With Electronic Voting

Skeptics of the electronic voting solution claim that fraud can occur digitally. When going to a polling location, voters in most countries are required to provide a form of photo ID to confirm that they are the registered voter they claim to be. While fraud for in-person voting is possible, it requires a false photo ID, which is hard to come across.

With online voting, voter identification would have to occur with some other type of credential. This could include Social Security numbers, dates of birth, driver’s license numbers, or some other unique identifier.

The problem with using these types of verification is that anyone who obtains these pieces of information could log in and cast a vote for someone else. If someone obtained a large amount of these identifiers with a data breach

A Scary Look Back at History’s Worst Data Breaches

A Scary Look Back at History’s Worst Data Breaches

Read More

, they would be able to cast thousands of fraudulent votes.

Manufacturer Bias Can Influence Votes

Another issue is how electronic voting systems are designed. These would be created and distributed by a private company, who will likely keep their source code locked away. Elections can have a huge effect on business, so company bias becomes an element when purchasing voting machines or systems.

When the government hires a company to implement its electronic voting machines, it’s trusting said company to accurately collect and report its votes. There’s no guarantee that this will occur, and many believe that no system should ever be implemented if it can’t guarantee fair and unbiased voting.

The Initial Costs for Digital Voting Is High

Finally, there’s the high upfront cost of installation. It would save in the long run, but the initial expenditure would be much larger than paper voting. Costs include the voting machines, maintenance and installation, testing the infrastructure, and securing the premises.

Is Electronic Voting Worth It?

While it may seem like the choice must be either traditional paper ballots or modern electronic voting, the truth is that there is a middle ground. There are plenty of advantages and disadvantages to EVMs, online voting, and paper voting. As such, the best solution is to mix traditional methods with digital ones, so that voters get the best of both worlds.

Some voting stations use scanner machines to read paper ballots to do all the hard work. If voters are overseas and can’t return to vote (for example, deployed soldiers,) there are systems that let them vote online. As such, it’s hard to say that one method is strictly better than the other. A system may be a perfect fit in one case but do poorly in another.

Because of this, it makes it almost impossible to say whether electronic voting is “better” than traditional paper voting. As technology advances, however, we may see digital voting replace paper voting as the superior way to make your voice heard.

Making the Voting Process Easier

Right now, electronic voting isn’t the perfect replacement for paper voting. There are many pros and cons to electronic voting, and the cons are currently too strong to replace paper voting. However, as these problems are ironed out, maybe we’ll all be voting in pajamas in the future.

If you want to delve deeper into politics, be sure to check out this site that shows accurate voting history and patterns for US politicians

This Site Shows Accurate Voting History & Patterns for U.S. Politicians

This Site Shows Accurate Voting History & Patterns for U.S. Politicians

No matter your political views, getting valid information on candidates is essential. VoteSmart is a bipartisan, vital resource for learning all about a politician’s views and actions.
Read More


Source link

Utah county moves to expand mobile voting through blockchain

Disabled voters in Utah County will be able to use their smartphones to vote in the November municipal election, an expansion of an earlier pilot test of the blockchain-based technology and anothert step toward allowing all voters to cast ballots with a mobile device.

The county, which has more than a half million residents, is the third in the U.S. to partner with Tusk Philanthropies, a non-profit focused on expanding mobile voting nationally. The latest pilot is a collaboration between the Utah County Elections Division, Tusk Philanthropies, the National Cybersecurity Center and Boston-based voting app developer Voatz.

iPhone iOS voatz blockchain voting Voatz

Voatz iPhone mobile voting application.

“I think it’s a great expansion on the mobile voting project,” Michela Menting, a director with ABI Research, said via email. “I think there is certainly potential to extend such technology to the general public, but it is always contingent on succeeding in smaller focus groups first, and especially those which may often find it more difficult to vote – due to location or disability as in this example.”

Utah County chose to expand the use of mobile voting after the National Cybersecurity Center (NCC) recently completed an audit of an August municipal primary election pilot that used the mobile voting app; the audit found that the results were accurate. Disabled voters will be able to use the app in upcoming municipal elections.

“I made the decision to utilize it for our disabled community after that,” said Amelia Gardner, Utah County Clerk and Auditor. “It was used twice in West Virginia for overseas voters, twice in Denver for overseas voters; so, in addition to my use of it in the municipal primary, that gave us five solid examples of clean audits coming back showing the votes were true.”

Utah County, which has 265,000 active registered voters, used the mobile voting app in a municipal election earlier this year for absentee military service members and their families living overseas. Only 45 voters took advantage of it, but the pilot went smoothly. This time around, Gardner expects there’ll be dozens of disabled registered voters who’ll be able to cast their votes through a smartphone to avoid having to go to a polling station.

“We’re excited about it. It’s made things a lot more simple on our side and increased our confidence in the quality of the overseas votes,” Gardner said. “We have been working closely with the Disability Law Center in the state of Utah to get the word out, but municipal elections are always a smaller election anyway.”

To date, the Voatz mobile voting platform has been used in four public election pilots (and about 40 elections overall): the 2018 West Virginia Primary Elections; the 2018 West Virginia Midterm Elections; the 2019 City/County of Denver Municipal General Elections; and the 2019 City/County of Denver Municipal Runoff Elections.

The NCC also worked with Voatz to develop a web-based tool that displays the voter-verified receipt, the tabulated ballot image and the blockchain-based ledger transaction. The ballot can then be printed out and inserted into a scanner with other paper ballots.

Using the mobile app also simplifies the typically labor-intensive process of dealing with absentee ballots, Gardner said. “Previously, overseas voters cast their ballots with email, but there was no way to verify their ID and no way to know if their email system had been hacked or if they were really the person responding to the email or not,” she said.

“On top of that, we had to have an employee read the email and fill out a paper ballot, and have a second employee verify they read the email correctly. It’s very labor intensive and very manual,” she said. “With this process, once the vote is recorded in the blockchain it generates a paper ballot and we run that through our scanners with all the other ballots and it maintains the secret ballot for that citizen.”

Voatz is among a small community of mobile voting platforms using blockchain as a distributed voting system; other firms include Votem, SecureVote, and Scytl. While only a small number of vendors offer it, mobile voting is gaining the attention of municipal officials for its ease of use and purported privacy and security.

The city of Vineyard, Utah – one of the fastest-growing cities per capita in the U.S. –  has asked Gardner for permission to use the mobile voting app for all residents, something that’s currently not legally possible. The city, which has grown from 5,000 residents to 15,000 in less than four years, has a large millennial population that is tech savvy, Gardner said.

Right now in the state of Utah, marking a ballot electronically is only allowed for citizens who fall under the national Uniformed and Overseas Citizens Voting Act (UOCAVA), which covers overseas absentee voters and disabled voters. If Congress were to enable mobile balloting for all registered voters, Gardner said she’d still require a few more audited pilots before she’d agree to opening the technology up to the general citizenry.

“I’m a fan, and most county clerks you’ll find are also fans, of introducing new technology incrementally. The first was UOCAVA voters in a smaller election and then in a little larger election; the next step I’d like to see would be all absentee ballots, whether you’re in another country or serving an internship in another state or caring for a sick family member in another state,” Gardner said.

The Voatz application uses a permissioned blockchain based on the HyperLedger framework first created by IBM and now supported by the Linux Foundation. In the election, verified validating nodes (servers) are used, split evenly between AWS and Microsoft Azure, each of which are geographically distributed, according to Voatz.

On the Voatz app, authentication is a three-step process that uses the smartphone’s camera and its biometric feature (either fingerprint or facial recognition). First, the voter scans their state driver’s license or passport; then they take a live facial snapshot (a video “selfie”), and finally they touch the fingerprint reader on the smartphone, which ties the device to the specific voter.

Once a voter is authenticated, the app matches the voter’s “selfie” to the facial picture on their passport or driver’s license and confirms eligibility to vote by checking the state’s voter registration database

“The voter photo-IDs and selfies are deleted soon after verification and are not used for any other purpose outside of voter identity verification,” Voatz CEO Nimit Sawhney said in an earlier interview. “Any biometric information never leaves the secure storage on the mobile devices and is not stored on remote servers.”

Not everyone, however, is sold on mobile voting – blockchain-based or otherwise.

Jeremy Epstein, vice chairman of the U.S. Technology Policy Council at the Association for Computing Machinery (ACM), said in a recent report that new technologies, including blockchain, fail to resolve insoluble security issues inherent with online voting.

“These issues include server penetration attacks, client-device malware, denial-of-service attacks and disruption attacks,” Epstein said in the report. “Infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots are both effective methods for large-scale corruption.”

Until there is a fundamental breakthrough to internet security, the best method for protecting election integrity is a tried-and-true one: mailed paper ballots, Epstein concluded.

While not tamper-proof, paper ballots “are not vulnerable to the same wholesale fraud or manipulation associated with internet voting,” Epstein said in the report.

ABI Research’s Menting said many have argued against mobile and blockchain voting because it’s not inherently safe and because there are too many “threat vectors, and unknowns, that could put the voting process in jeopardy.

“That is true to an extent, but so is paper-based voting,” Menting said. “I would argue that mobile and blockchain technology notably can provide a number of additional security features that offer robust-enough security to ensure the voting process is as secure (if not more secure) than existing voting mechanisms, especially regarding insecurity of ballot counting machines and systems. So I do believe that blockchain voting is safe.”

Of course, Menting added, any new technology initiatives, whether blockchain, mobile or otherwise, need to be continuously tested and verified to ensure they continue to meet the levels of security required in a voting setting.

“But to date, it looks like the Voatz system works, and well at that, and hopefully it continues to do so,” she added.

Copyright © 2019 IDG Communications, Inc.

Source link