This newer voting technology trial has already taken center stage in the 2020 presidential election. The Iowa Democratic Party made national headlines in February when it integrated a new app into its caucus format with hopes of expediting the reporting of results. Officials promptly discovered coding issues and unexplained factors that led to significant counting delays and general concerns about the reliability of voting technology, damaging public trust.
Public trust only exists when the election system is audited and transparent, and able to provide evidence, even against a false claim of irregularities. The Iowa caucus mishap highlights the risk technology introduces to the election process and stands as a warning to election officials and the federal government of the possible cyberthreat the presidential election faces.
We can expect to see other new election technologies in the 2020 presidential election, and the risks that go with them. To ensure the highest form of security and auditability of our elections, officials need to shift toward solutions that incorporate traditional hand-marked paper ballots and scanners, accompanied by mandatory risk-limiting audits that heighten transparency around the election. Here’s why.
A Modern System without Security
Over the last two decades, election officials have introduced technological changes to the nation’s voting system. As a result of the Help America Vote Act in 2002, which created $3 billion of funding to update aging voting systems, some states started using electronic direct recording, which records votes with electronic components and software without auditable physical evidence. Soon after, many election officials and organizations moved away from paper ballots and toward ballot-marking devices, which helped make the voting process universally accessible. This move has proven to be a mistake because it allowed election officials to modernize their systems without proper security standards.Some officials are still transitioning, against all recommendations from security experts, towards computerized systems in an attempt to streamline the voting and counting process. However, new features always add new vulnerabilities. For example, some states use barcode technology in place of ballot marking. It is a misconception that barcodes are safer than the traditional hand-marked paper ballots. In fact, the inherent non-readability of barcodes by humans allows hackers to make changes to the barcodes without the voter’s or the official’s knowledge.
Other advances can pose enormous cybersecurity issues. A recent study asked a group of students at the University of Michigan to participate in a mock election using a computer-aided voting style that is prevalent today in many states. Unbeknownst to the students, the machines were hacked for the purpose of testing the alertness of the voters. With less than 8 percent of participants correctly reporting anomalies on the printed ballot, the study demonstrated how voters are unable to detect irregularities on paper caused by faulty software or malicious actors.
Officials are looking to technology to alleviate inefficiencies, but the issue is deeper than that. In addition to new types of vulnerabilities, the industry lacks appropriate security standards and a culture for technology vendors to test against.
The Need for Universal Security Standards
Today’s election systems and electronic pollbook systems are required to meet minimal universal standards, which means the vendors don’t have to test their technologies against a set of standards or be subject to independent, public testing. Complicating matters are the many companies that sell maintenance and operational support for election systems, but are not regulated and are not required to have their services certified or audited.Without a set of universal standards to test against, there’s potential for heightened risk of interference during elections. Many local election officials do not have the awareness or resources to address the issue themselves.
Hand-marked Paper Ballots Make a Comeback
Elections are unique because they require a secret ballot and auditability, and they do not allow for correcting errors. Consequently, the deployment of digital voting solutions, such as mobile voting, is fundamentally different for elections than, for example, the e-commerce or online banking industries. Internet or mobile voting is not possible in U.S. elections because the cryptography needed does not exist, and the technology to monitor those distributed endpoints is not in place. That’s one of the reasons why many states are going back to the basics with hand-marked paper ballots.Even if hand-marked paper ballots make a comeback, our elections are complex and require technology to process the paper ballots. Since all systems today and in the foreseeable future can still be hacked, auditability is the most important consideration in elections. While security must be improved, the key is to have mandatory audits, such as risk-limiting audits to always verify the results from the paper ballots. During risk-limiting audits, paper ballots are randomly chosen and tallied until it is proven that the election has been called for the correct winner. This form of public audit makes certain that results are accurate.
Democracy is about the peaceful transition of power, and that notion is only possible if all parties — winners and losers — can trust that the results are a fair and accurate representation of votes. Only transparency to all steps of the process will provide the proof needed to support the trust. Many states do use hand-marked paper ballots, but if there is not a national shift toward this ballot approach, the cybersecurity risk will continue to rise and elections will become increasingly susceptible to interference.
Dan Webber, CIO of Nordic Innovation Labs, has worked as a chief information officer, security officer, and technology officer for 22 years; 13 of those years have been spent in health care and biotech, and nine years in manufacturing, technology and hospitality companies. He advises companies that provide artificial intelligence/machine learning, cybersecurity, innovation, design, analytics, advanced computing and digital services to large private and public enterprises around the world. Dan will be speaking at RSA Conference 2020.
Mr. Harri Hursti, the founding partner of Nordic Innovation Labs, is a world-renowned data security expert, Internet visionary and serial entrepreneur. He is a world-leading authority in the areas of election voting security and critical infrastructure and network system security. Harri is an RSA Conference 2020 speaker.
Maggie MacAlpine, founding partner of Nordic Innovation Labs, is an election security specialist, serial entrepreneur, and one of the co-founders of Nordic Innovation Labs and of the DEF CON Voting Machine Hacking Village.
