June 11, 2020

A Dire Cybersecurity Warning About Online Voting

There has been much discussion recently about the need for online voting in the United States—an issue made all the more current by the COVID-19 pandemic. Clearly, if online voting could be made credible and secure, it would help increase voter participation in the U.S.—which was only 55.7% in the 2016 presidential election.

Some of the discussion surrounding online voting has centered on the issue of cybersecurity—and, unfortunately, much of the debate has devolved into partisan bickering. Now, two scholars (from MIT and the University of Michigan) have analyzed the cybersecurity risks of one particular web-based platform (Democracy Live's OmniBallot). Three states—Delaware, New Jersey and West Virginia—have already allowed certain voters to use the OmniBallot platform. The two researchers (MIT's Michael A. Specter/Michigan's J. Alex Halderman) concluded that "using OmniBallot for electronic ballot return represents a severe risk to election security and could allow attackers to alter election results without detection." 

They also recommended a range of "procedural defenses" to the platform to reduce cybersecurity risks. The researchers do see tremendous potential value in the OmniBallot platform for ballot delivery and even ballot marking—but it's on the issue of online ballot return that serious concerns arise. They state, "Online ballot return, however, represents a severe danger to election integrity and voter privacy. At worst, attackers could change election outcomes without detection, and even if there was no attack, officials would have no way to prove that the results were accurate. No available technology can adequately mitigate these risks, so we urge jurisdictions not to deploy OmniBallot’s online voting features."  Election integrity is essential to citizen confidence in our democracy. Rushing into universal on-line voting, without implementing national state-of-art cybersecurity measures, may very well be inviting a crisis.

=====================================================================
You can read the full academic article by Specter and Halderman HERE.