Imagine what would happen if, six months after an internet-based election, we learned that the election had been hacked and the wrong people declared the winners? Or, if a group claimed to have hacked the election and we can’t be sure whether or not they succeeded?
There are many positive uses of the internet in elections, e.g. online voter registration, providing polling place information, etc. However, sending voted ballots over the internet puts our elections at risk. Yet, 34 states and the US Virgin Islands allow some type of electronic transmission of voted ballots for some voters.
Internet voting differs from other internet-based activities such as banking and e-commerce because of a critical right guaranteed by every state: the secret ballot. If I purchase a book online, I want the seller to know the name of the book. But I don’t want my local election official to know how I voted. If the book I ordered fails to arrive, I’ll ask the seller to resend. But if my ballot is hacked and my vote changed, I almost certainly will not know, let alone get my ballot replaced.
We frequently hear of major successful internet attacks. For example, this past February, there was a major security breach of the Marshals Service in which a vast amount of personal information about agency employees and investigative targets was stolen. Even more disturbing was an earlier Russian attack. According to a report from The New York Times, “The Pentagon, intelligence agencies, nuclear labs and Fortune 500 companies use software that was found to have been compromised by Russian hackers. The sweep of stolen data is still being assessed.”
How could underfunded and under-resourced local election officials protect their systems from attack by a nation-state or even wealthy partisan interests when institutions such as nuclear labs, intelligence agencies, and the Pentagon, each with far more resources and expertise, are vulnerable?
Remote electronic voting – including voting online via email, FAX, a web portal, or a mobile phone app – has been analyzed and found insecure by virtually all cybersecurity experts for the past 20 years. In 2018, the National Academies of Science, Engineering, and Medicine wrote in Securing the Vote: Protecting American Democracy, “We do not, at present, have the technology to offer a secure method to support internet voting. It is certainly possible that individuals will be able to vote via the internet in the future, but technical concerns preclude the possibility of doing so securely at present.” The Department of Homeland Security, FBI, Election Assistance Commission, and National Institute of Standards and Technology subsequently concurred with the Academies’ statement in Risk Management for Electronic Ballot Delivery, Marking, and Return.
As the Academies report explains: “Malware – malicious software that includes worms, spyware, viruses, Trojan horses, and ransomware – is perhaps the greatest threat to electronic voting. Malware can be introduced at any point in the electronic path of a vote – from the software behind the vote-casting interface to the software tabulating votes – to prevent a voter’s vote from being recorded as intended.” In response to claims that blockchains can provide the needed security for internet voting, the report states: “… blockchain technology does little to solve the fundamental security issues of elections, and indeed, blockchains introduce additional security vulnerabilities.”
Election results also could be altered by denial of service attacks, possibly targeting select groups of voters, that prevent people from voting.
Internet voting is not a viable solution for either overseas voters or voters with disabilities, because it sacrifices both secrecy and security.
- For military voters, the 2009 MOVE Act improved the voting process for military/overseas voters by requiring states to provide blank ballots electronically to voters who request them starting 45 days prior to Election Day. Those voters can download, print, mark, and mail back their ballots. Free expedited mail return is provided for overseas military voters. Most states accept late-arriving ballots from military voters as long as they are postmarked by Election Day.
- For voters with disabilities who vote in person, every polling place must have at least one accessible voting system. For those voting remotely, many states provide a Remote Accessible Vote By Mail (RAVBM) option that provides a voter with the ability to mark a fillable form remotely on her own accessible device, print the ballot, and return it via mail or drop box. Some localities provide mobile voting units for individuals or institutions such as assisted living facilities. For those who can use them, most states will provide a mail ballot that can be hand marked to any voter’s home. There is no one-size-fits-all solution, but internet voting imposes exceptional risks and for that reason is not yet a viable option for voting.
Mail-in ballots have some risks, but those pale in comparison to the risks of internet voting. A major attack on mail-in ballots would require a conspiracy involving many attackers who would need to be physically present in order to steal the ballots. By contrast, internet voting can be attacked from anywhere in the world. It might even be possible for a single highly skilled hacker to alter the outcome of a major election that included internet voting.
Internet voting is a threat to the integrity of our elections and to the national security of the United States. It is a risk we cannot afford to take.
How you can help: Learn about your state by clicking on “Equipment Search” at https://verifiedvoting.org/verifier/#mode/navigate/map/ppEquip/mapType/normal/year/2024. Depending on what you find, make sure that your local election official (that information is obtainable from the above link) and your state representatives know of your opposition to all forms of internet voting. Instead, they should support secure election reforms such as making polling places more accessible for voters with disabilities, providing RAVBM systems to all states, and accepting overseas ballots for several days after Election Day.