The hacker downloaded the app during the election in question and registered, Sawhney said. The hacker hit one of the system’s tripwires after engaging in suspicious behavior and was blocked and reported. Specifically, the hacker downloaded the app on a second device and then tried to connect their device potentially to a computer.
Sawhney said such activities on Voatz are considered “highly unusual.” However, he could not confirm whether the person was “naïve and silly” or attempting to be malicious.
“It’s hard for us to judge,” Sawhney said. “We can’t read their mind.”
Although the attempted hack on Voatz happened late last year, the news about it only broke about two weeks ago. The FBI is investigating the situation. At this time, no authority has publicly identified a suspect.
The Voatz app has inspired concern among those in government and the cybersecurity space. Last week, the Democratic National Convention could not come to a consensus on whether Voatz should be allowed during Alaska's Democratic primary next year. And some technology experts continue to raise questions about the app's legitimacy.
However, multiple officials who have utilized Voatz in elections told Government Technology that they were not worried about the reported hacking attempt.
Utah County Clerk/Auditor Amelia Powers Gardner said her county plans to expand its use of Voatz this November. Earlier this year, Utah County allowed overseas voters to mark their ballots with the Voatz app and hosted a live vote-auditing demonstration. Later this year, the county’s disability population will be able to use the system.
“I think that this failed [hacking] attempt really shows the system works as designed and that the system is significantly more robust than the email votes that we were currently using for overseas voters,” Gardner said. “We all know that people try to meddle with elections.”
Josh Daniels, chief deputy of the Utah County Clerk/Auditor’s Office, said he and Gardner were aware of the hacking attempt well before the news broke and that, as a result, went into their election with “eyes open with more confidence in the system.”
“It wasn’t news to us,” Daniels said. “When we first sat down with Voatz before we undertook our pilot, they explained that there had been an attempt in 2018, but that the system worked as designed by detecting the attempt, identifying the attempt, and reporting the attempt to West Virginia, and that West Virginia had reported it to the FBI.”
Gardner added that Voatz communicated to her office that both it and the FBI had determined that the hacking attempt was “not close” to success.
In contrast, Jocelyn Bucaro, director of elections in Denver, said she was not aware of the attempted hack before her city allowed overseas voters to use Voatz during a May 2019 municipal election. But when she did read the news, she thought the system worked as it should and that Voatz was very forthcoming about the intrusion. Bucaro added that if changes to Colorado law could be made, she would be interested in offering Voatz to the disability population as a voting option during municipal elections.
Sawhney said if the West Virginia election hacker had made it to another step in the voting process, they would have triggered another one of several tripwires. Voatz requires identity verification, and the hacker would have been stopped if they had tried to use a fake ID, a selfie of someone else or a picture of a picture.
Voatz also blocks users from voting if it detects that their phone has been compromised. But if someone were to circumvent that line of security, they would then have to break through various encryptions and access the voter’s unique cryptographic key.
“You have to do this in a very small amount of time because your window to compromise the ballot is like microseconds,” Sawhney said. He added that given the short timeframe required for a successful hack, it would be impossible to compromise votes “en masse.”
Sawhney shared other hypotheticals. If you try to kill a node on the Voatz blockchain, another one will come up, like a “whack-a-mole” game. If you try to tamper with data on the chain, everybody on the Voatz side will know, and you will get kicked out. Additionally, Voatz leaves behind a paper trail so that the authenticity of votes can be verified.
Sawhney said he encourages researchers, students and others to hunt for flaws in Voatz — with a caveat. Do it as part of Voatz’s bounty program. Don’t do it on the live system.
“Give us feedback like hundreds of people already have,” Sawhney said. “We love that feedback. It goes directly into our product to improve it. But please do it the right way. Don’t mess with the live system, because you will get into trouble.”
