This commentary is by John Odum, who is the Montpelier city clerk and a certified ethical hacker.
The Legislature will be coming back into session in no time, and that means we’ll hear more about a major elections bill that, among other things, would allow for a limited amount of online voting.
Getting ballots to overseas and deployed military voters has been a real hobgoblin for election administrators. Online voting, the thinking goes, would make that a non-problem. It’s a noble goal with a seemingly elegant solution.
I wear a couple of different hats. As the city clerk in Montpelier, I am my community’s election administrator. As a certified ethical hacker, I also know about causing mischief in computer systems. Wearing both hats simultaneously, one thing becomes clear: Online voting is a bad idea.
It doesn’t really make a difference that we’re talking about implementing it only for such a small subset of voters. As they say, what’s sauce for the goose is sauce for the gander. If we allow online voting for one set of voters, it’s only a matter of time until it’s allowed for all. Didn’t early ballot mailing (a very good thing, by the way) eventually become universal mail-in voting for all in many jurisdictions?
The argument for online voting often goes, if I do my banking online, why can’t I vote online? Online banking and e-shops are common targets for phishing attacks (attempts to trick users into revealing access to their systems) and are not as secure as we’d all like, let alone as secure as voting should be. It’s a scare we’ve all had at one time or another.
Last year there were 57,219 Android malware (computer viruses and the like) attacks reported by Kaspersky — and what we know is probably the tip of the iceberg.
However secure the internet-based link between the voter and the voting tabulator can be made, the real problems are endpoints. And a compromised voter’s credentials could compromise others as well. A hacker could use “privilege escalation” techniques to wriggle into the entire system.
Online voting proponents will note strategies to prevent such unwelcome activity, but “Advanced Persistent Threats” (backed by nations such as Russia and Iran) are practiced at avoiding intrusion detection systems. That’s why critical infrastructure hacks are reported every year.
The “tabulator” end is vulnerable as well. “Distributed Denial of Service” attacks, designed to crash computer systems, could take down voting infrastructure. No system is going to be completely invulnerable to such attacks. Amazon Web Services was taken down by a dDos attack of a scale many didn’t even think possible in 2020.
The mantra of the professional penetration tester is that nothing is unhackable. That is the persistently inconvenient truth.
This is why the Defense Department as well as Finland and Sweden have backed away from internet voting in the past. It’s also why last December, the Center for Security in Politics at Berkeley described internet voting as a non-starter. Seven other states currently use some sort of online voting, but these instances, again, are for small segments of the electorate. Larger-scale use would be a more enticing target for hackers.
These concerns are, granted, largely theoretical. This or that “could” happen.
Here’s what will happen.
Universal online voting would become the biggest tool for voter suppression ever seen. Imagine for a minute a phishing email that looks to be from a voter advocacy group of even the Secretary of State, purporting to help you, or direct you to your online ballot or voting portal. Just a click and you go to a website that might look exactly like an online voting website but is actually a malicious one.
Not only will you see many people who thought they had cast a ballot being disenfranchised, but you’ll also see an increase in identity theft as well via the same attack vector.
And if you believe these kinds of strategies don’t work, you’re wrong. Phishing emails have a nearly 20% success rate. If those are microtargeted, the number can go up to nearly 70%.
Do the math. If you start with the number of voters participating in an election, apply the percentage of commercially attainable email addresses and target demographics, then apply a 20% success rate, you get to some scary numbers.
This is how you can truly turn an election result. Nothing fancy. Just good old-fashioned phishing.
Think this outcome is theoretical? Every election, there are thousands of robocalls across the country designed to frighten or keep people from the polls. Calls about fictional threats, or changes of election dates. Online voting would magnify the problem by giving those strategies a massive avenue with which to disenfranchise voters.
Who gets targeted? Who always gets targeted?
Communities of color. Seniors. Other communities susceptible to microtargeting. The hard truth is that online voting becomes a social and racial justice issue in almost no time — whether we choose to acknowledge that or not.
My plea to the Legislature is very simple: Can we please stop talking about this? Some solutions are worse than the problems, and online voting is the poster child for that.
