West Virginia to Allow Smartphone Voting
Cyber security experts are quite alarmed.
Disabled residents of the Mountaineer State will be the first in the nation to test voting by app. While the experiment could make exercising the franchise much easier it comes with significant security risk.
West Virginia is moving to become the first state to allow people with disabilities to use technology that would allow them to vote with their smartphones in the 2020 election.
Gov. Jim Justice, a Republican, plans to sign a bill by early next week that will require all counties to provide some form of online ballot-marking device to every voter with physical disabilities, according to West Virginia Secretary of State Mac Warner.
Warner, the state’s chief election official, said that he would most likely provide counties with the smartphone app Voatz or a similar app, making the choice easy for cash-strapped counties.But cybersecurity experts have long railed against apps like Voatz, saying that any kind of online voting unnecessarily increases security risks.
“Mobile voting systems completely run counter to the overwhelming consensus of every expert in the field,” said Matt Blaze, a computer scientist at Georgetown University and a seasoned election security researcher. “This is incredibly unwise.”
Researchers have not identified any specific security problems with Voatz, but broader concerns about the app and election security in general have spurred greater scrutiny of it. In November, Sen. Ron Wyden, D-Ore., sent a letter to Defense Secretary Mark Esper asking for a review of Voatz.
Despite expert opposition, a growing number of counties across the U.S. are adopting Voatz or other forms of smartphone voting. In 2018, West Virginia was the first state — and remains the only one — that offered all counties the option to use Voatz for military and overseas voters.
[…]
The Department of Homeland Security, the federal agency that offers election security assistance and advice to state and county election officials, declined to comment. But its top cybersecurity official, Chris Krebs, has repeatedly cited the National Academy of Sciences report on election security, which says online voting currently is untenable as a secure technology, as an authoritative guide.
But allowing voters with disabilities access to online voting is a matter of “risk benefit analysis,” Warner said. A 2017 Government Accountability Office study found that polling places are rife with difficulties for people with disabilities. West Virginia has the highest rate of people with disabilities in the country, according to a 2015 Pew study.
Advocates of increasing voter turnout, and thus make our elections more democratic, have long supported online voting. But there have been fears going back to at least the 2004 cycle that even in-person electronic voting machines are vulnerable to sabotage.
Given the tensions in our current political climate, opening any window for hacking the voting tally—whether by domestic or foreign actors—is just insane.
Beyond that, while we should certainly make reasonable accommodations for the elderly, disabled, and others who have difficulty with voting in-person, it’s not obvious why having them download and familiarize themselves with a phone app is preferable to a standard absentee ballot. Those, too, raise concerns about mischief but they at least leave a paper trail that can be examined after the fact.
The amount of money transferred electronically every year is in the quadrillions of dollars. SWIFT, ACH, FedWire, dozens of other systems. The Electronic Funds Transfer Act was passed in 1978. I transfer money between accounts on this here iPad with nary a worry.
The idea that we can’t do secure online voting is ludicrous.
@Teve: I’m not an expert on cybersecurity but the National Academy of Sciences assembled a panel of people who are and came to a far different conclusion. Their report is linked above and again in this comment.
As to your specific point, David Jefferson, a computer scientist at Lawrence Livermore National Laboratory, answers it with a lengthy piece titled “If I Can Shop and Bank Online, Why Can’t I Vote Online?” The upshot:
He explicates those arguments at some length. But this point is worth noting here:
a funny xkcd that disagrees with me. 😀
@James Joyner: I’ll read some Bruce Schneier articles on the subject when I get off work, and reconsider. But about the sensitivity issue, I expect online voting would massively increase turnout, which would reduce sensitivity.
A bad idea wrapped in good intentions. I’m sitting here thinking of my 84 yo mother and 85 yo mother-in-law, neither of whom ever used a PC much less a smart phone. My mother’s last experience with a computer was a green screen DEC mini, my mother in laws a Wang word processor.
@Teve:
Swift was hacked a couple of years ago.
Okay i just read this and I was wrong. Online voting is fatally flawed.
It is the 21st century, voting is going to go online. Perhaps the cybersecurity experts should be spending their time figuring out how rather than kvetching. Incidentally, I worry more about the security of reporting data from the polling place to the central whatever than I will about the votes of a small number of individuals in WV. Were I the Russians I’d be going for wholesale meddling, not retail.
The idea that Republicans would be in favor of something because it increases turnout is ludicrous on its face. Absentee ballot fraud and, soon, online voting fraud are by far the easiest ways to cheat. Actual get out the vote is not the Republican way. Can you imagine some tea party d-bag armed with an AK-47 showing up to “help” a crippled old black woman to vote?
@gVOR08: All due respect but we are so far from secure online voting it’s not even worth thinking about. How the hell would you ever know who was casting that vote? My god, every nursing home in the state would turn out 100% for the Republican. Didn’t we just have an election overturned because the Republican was pulling the nursing home scam with an absentee ballot?
I expect online voting would massively increase turnout, which would reduce sensitivity.
I live in one of the vote-by-mail states. The process is pretty much as easy as any secure voting can be. The evidence is that it might increase turnout slightly, but not by much. Non-voters continue to skew heavily young and minority. The reasons for not voting remain unchanged: I forgot, it doesn’t matter, it’s too inconvenient. I expect voting by app will have the same minimal effect on turnout.
We’re also an initiative state. There is some evidence that a controversial ballot initiative does more to drive turnout than anything else . People apparently like voting on specific policy questions.
@MarkedMan: Jim Justice is a weird cat but his policy preferences run the gamut. West Virginia is an unusual state, in which Joe Manchin is a Democrat and no Republican has won election as governor in almost two decades. (Justice, a lifelong Republican, won as a Democrat but later switched back to the GOP.)
@James Joyner: I spoke in frustration when I implied that only Republicans would benefit from cheating. Heck, I grew up in Chicago and currently live in Baltimore so I have no illusions as to what entrenched politicians of any stripe will do to protect their own.
Imagine that there is a close election and an hour before the polls close an extra thousand or so voters who haven’t yet cast votes and who, say, have never voted in a non-presidential election in their lives suddenly cast a vote for the machine candidate. Who would even know that happened? And cheating is most likely to be done by the incumbents because they control the mechanisms that would alert that something odd had happened and investigate that alert.
@James Joyner: I should add that whatever politician may be in power, West Virginia has fallen into the “very corrupt” category at every level of governance for as long as I remember.
@Michael Cain:
I am on a permanent vote by mail list. I don’t see how computer voting would be significantly easier, plus paper ballots give a nice feeling of security.
(This is why we didn’t know Sinema had won for several days after the election – the majority of the votes in AZ come in by mail.)
@charon:
I find it amusing that both Arizona and California have become effective vote-by-mail states using archaic absentee ballot systems intended to handle a small percentage of the total ballots. When Colorado, Oregon, and Washington committed to vote by mail, they bought automated systems designed for the purpose and report their results in a reasonable amount of time. IIRC, it was the 2018 election where I saw a picture from Arizona during the interminable counting showing an old lady flipping through a big registration book to match signatures. At about the same time, I saw a video from my Colorado county showing the machine that matched signatures at a rate of several per second in operation. For those who worry about such things, the continuous audit process in Colorado shows that the machines are much more accurate than people at signature checks.
@Michael Cain:
Dino Rossi would disagree. He was ahead during the initial ballot drops, and then fell behind days later. It was great. This was repeated on two recounts. There was a rematch four years later, but sadly Rossi was behind on the first ballot drop so his suffering was short.
I now put my ballot in the mail on the day of the election — to ensure that it does not get counted in the first ballot drops, just to maximize the drama.
Regardless of voting method, there should be a paper receipt somewhere.
@Michael Cain:
So no reliable exit poll data for AZ/CA. That’s enough voters so no reliable nationwide exit polling either.
@charon:
Plus CO, OR, and WA. In 2020 add HI. UT allows counties to make the decision; all but two have already switched to vote-by-mail, and the holdouts are expected to switch in 2020. IIRC, MT has a permanent no-excuse absentee ballot list and about half of all ballots cast there are cast by mail. In 2020, in the Census Bureau’s western region, a large majority of the votes cast will be cast by mail.
Of course, for Electoral College and Senate purposes, the only one of those states of interest this year is Arizona :^)
While I still think this is a bad idea (for a variety of reasons), I suggest everyone read one of the first linked articles for some additional context:
https://www.newsandsentinel.com/news/local-news/2020/01/mobile-absentee-voting-proposed-for-people-with-disabilities/
This app has already been used for past elections:
All that said, this is significantly scaling up this program (not to mention applying it to a very different use case — i.e. people with disabilities). It shouldn’t be piloted during a major election year — especially not this relatively late in the cycle.
Beyond security challenges, there are a LOT of design challenges (both potentially in terms of interface and building the overall service infrastructure to help educate, build awareness, and support users). As someone who works in that business I can tell you that is not something you get done overnight (or even in 9 months).
Also, a review of the Voatz wikipedia page makes me feel even worse about this idea:
https://en.wikipedia.org/wiki/Voatz
@gVOR08: It’s possible (probably likely) that WV’s population–1.8 million, only 10 states have smaller populations–makes the impact of hacking whatever percentage of the population (which will undoubtedly be a small percentage of the total) marginal at best.
Sadly, that fact is likely to resolve to “an infinitesimally small sample of an infinitesimally small state had no unmanageable problems, so it’s bound to work even better in a large sophisticated state like California.” And that’s thinking is why is a stupid idea.
But your right; it is the wave of the future. (The fact that it’s a stupid idea almost guarantees that.)
“Cyber security experts are quite alarmed” And alarmed they should be. There are many factors here, not the least of which are dropped signals while someone is voting, and interference from solar storms.
“Smart” devices: one of these days Alexa is going to be telling me what to do. She is five years old, so not married. She also said that she is not hot or cold. Her favorite team is the Seattle Seahawks! Are you kidding? I might swap her for someone else!
@Tyrell: Bravo! Nine out of ten.
@Tyrell:
Actually, I think those are literally the two least important concerns. I’m impressed. I now think the performance artist behind Tyrell is a software engineer.
With a decently awesome solar storm, and SSL, it’s basically a dropped connection. Flipped bit? Can’t decrypt the payload.
And dropped connections are handled with retry and idempotency (run the same data, make the change once… lots of ways to do that)
Anyone who thinks Tyrell is a troll does not understand performance artists. Bravo, good sir, but you’re letting the mask slip — too specifically ignorant.
On a semi-related note, the Gustopher Show is about to make an onsite appearance at some unsuspecting company in the greater Seattle area. I get bored with jobs, so I entertain myself by playing a character — Bill McNiell from Newsradio.
I applaud Tyrell for years of continuous mostly-in-character posts.
As my 78 year old mother’s amateur systems administrator, the thought of this being rolled out to the elderly on a large scale fills me with dread.
At the same time, in Texas, there is apparently no enforceable statue that requires counties to only select ADA compliant buildings as polling sites. We have county-wide voting centers, which reduced the number of overall polling places but allow each voter to decide which voting center works best for them instead of forcing people to return to their precinct to vote. The first election that they were implemented, my mother spent all day trying to vote because she was unable to enter the first two buildings she tried to vote at and kept returning home to look up the directions to a different one. She lucked out on the third try, and then slept for sixteen hours.
@Gromitt Gunn:..she was unable to enter the first two buildings she tried to vote at…
I not only worked as a personal attendant for my quadriplegic friend Joe I also spent a fair amount of time hanging out with him so I quickly became aware of the barriers to life in a wheelchair. Twenty years before there was an ADA.
I am curious. Is your mom wheelchair bound or is she unable to negotiate stairs?
(At 72 I can relate to stair climbing as a true challenge to mobility.)
@MarkedMan:
they mocked us when we told them that this is art.
@Gustopher:
i like to think of it as a nod to those who are still paying attention.
@Kathy:
But how would you know that what’s on the receipt is what was recorded as your vote in the computer?
Voting should be done by paper ballot. Electronic voting, whether it’s done with an app, on the computer, on a voting machine, etc should be banned.
@Mister Bluster: Unable to navigate stairs / curbs if the rise is too high and/or their are insufficient handrails. Even ramps can be too steep without adequate handrails.
In one case, she got all the way from the parking lot to the main entrance of the church, when suddenly she couldn’t proceed any further. In the second (also a church), the voting area was in a different part of the the building from the part that built to be handicap accessible. So she parked in the handicap are and made her way fully inside before learning that she was in the wrong area.
@Michael Cain: How does a state or county ensure voters who are blind can vote without giving up their right to secrecy? Paper ballots require voters who are blind to have someone mark their ballot for them. Isn’t protecting the right to vote just as important as securing it? What if the tech has lots of security that can detect an attempted hack? Seems like a balance between allowing voters who otherwise couldn’t vote secretly with security and limited use of voting electronically.