![](\"https:\/\/media.wired.com\/photos\/5b69f0d24644980a2c29a1c1\/master\/pass\/MilitaryVote-Biz-534338160.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Emily Dreyfuss| Date: Thu, 09 Aug 2018 16:41:42 +0000<\/strong><\/p>\n When news hit<\/a> this week that West Virginian military members serving abroad will become the first people to vote by phone in a major US election this November, security experts were dismayed. For years, they have warned that all forms of online voting are particularly vulnerable to attacks, and with signs that the midterm elections are already being targeted<\/a>, they worry this is exactly the wrong time to roll out a new method. Experts who spoke to WIRED doubt that Voatz, the Boston-based startup whose app will run the West Virginia mobile voting, has figured out how to secure online voting when no one else has. At the very least, they are concerned about the lack of transparency.<\/p>\n \u201cFrom what is available publicly about this app, it's no different from sending voting materials over the internet,\u201d says Marian Schneider, president of the nonpartisan advocacy group Verified Voting. \u201cSo that means that all the built-in vulnerability of doing the voting transactions over the internet is present.\u201d<\/p>\n And there are a lot of vulnerabilities when it comes to voting over the internet. The device a person is using could be compromised by malware. Or their browser could be compromised. In many online voting systems, voters receive a link to an online portal in an email from their election officials\u2014a link that could be spoofed to redirect to a different website. There\u2019s also the risk that someone could impersonate the voter. The servers that online voting systems rely on could themselves be targeted by viruses to tamper with votes or by DDoS attacks to bring down the whole system. Crucially, electronic votes don\u2019t create the paper trail that allows officials to audit elections after the fact, or to serve as a backup if there is in fact tampering.<\/p>\n But the thing is, people want to vote by phone. In a 2016 Consumer Reports<\/em> survey of 3,649 voting-age Americans<\/a>, 33 percent of respondents said that they would be more likely to vote if they could do it from an internet-connected device like a smartphone. (Whether it would actually increase voter turnout is unclear; a 2014 report<\/a> conducted by an independent panel on internet voting in British Columbia concludes that, when all factors are considered, online voting doesn\u2019t actually lead more people to vote.)<\/p>\n Thirty-one states and Washington, DC, already allow certain people, mostly service members abroad, to file absentee ballots online, according to Verified Voting<\/a>. But in 28 of those states\u2014including Alaska, where any registered voter can vote online\u2014online voters must waive their right to a secret ballot, underscoring another major risk that security experts worry about with online voting: that it can't protect voter privacy.<\/p>\n "Because of current technological limitations, and the unique challenges of running public elections, it is impossible to maintain separation of voters\u2019 identities from their votes when Internet voting is used," concludes a 2016 joint report<\/a> from Common Cause, Verified Voting, and the Electronic Privacy Information Center. That's true whether those votes were logged by email, fax, or an online portal.<\/p>\n Voatz says it\u2019s different. The 12-person startup, which raised $2.2 million<\/a> in venture capital in January, has worked on dozens of pilot elections<\/a>, including primaries in two West Virginia counties this May. On a website FAQ<\/a>, it notes, \u201cThere are several important differences between traditional Internet voting and the West Virginia pilot\u2014mainly, security.\u201d<\/p>\n Voatz CEO Nimit Sawhney says the app has two features that make it more secure than other forms of online voting: the biometrics it uses to authenticate a voter and the blockchain ledger where it stores the votes.<\/p>\n The biometrics part occurs when a voter authenticates their identity using a fingerprint scan on their phones. The app works only on certain Androids and recent iPhones with that feature. Voters must also upload a photo of an official ID\u2014which Sawhney says Voatz verifies by scanning their barcodes\u2014and a video selfie, which Voatz will match to the ID using facial-recognition technology. (\u201cYou have to move your face and blink your eyes to make sure you are not taking a video of somebody else or taking a picture of a picture,\u201d Sawhney says.) It\u2019s up to election officials to decide whether a voter should have to upload a new selfie or fingerprint scan each time they access the app or just the first time.<\/p>\n "We feel like that extra level of anonymization on the phone and on the network makes it really really hard to reverse-engineer."<\/p>\n Nimit Sawhney, Voatz<\/p>\n The blockchain comes in after the votes are entered. \u201cThe network then verifies it\u2014there\u2019s a whole bunch of checks\u2014then adds it to the blockchain, where it stays in a lockbox until election night,\u201d Sawhney says. Voatz uses a permissioned blockchain, which is run by a specific group of people with granted access, as opposed to a public blockchain like Bitcoin. And in order for election officials to access the votes on election night, they need Voatz to hand deliver them the cryptographic keys.<\/p>\n Sawhney says that election officials print out a copy of each vote once they access them, in order to do an audit. He also tells WIRED that in the version of the app that people will use in November, Voatz will add a way for voters to take a screenshot of their vote and have that separately sent to election officials for a secondary audit.<\/p>\n To address concerns about ballot secrecy, Sawhney says Voatz deletes all personal identification data from its servers, assigns each person a unique but anonymous identifier within the system, and employs a mix of network encryption methods. \u201cWe feel like that extra level of anonymization on the phone and on the network makes it really really hard to reverse-engineer,\u201d he says.<\/p>\n Very little information is publicly available about the technical architecture behind the Voatz app. The company says it has done a security audit with three third-party security firms, but the results of that audit are not public. Sawhney says the audit contains proprietary and security information that can\u2019t leak to the public. He invited any security researchers who want to see the audit to come to Boston and view it in Voatz\u2019s secure room after signing an NDA.<\/p>\n This lack of transparency worries people who\u2019ve been studying voting security for a long time. \u201cIn over a decade, multiple studies by the top experts in the field have concluded that internet voting cannot be made secure with current technology. VOATZ claims to have done something that is not doable with current technology, but WON'T TELL US HOW,\u201d writes Stanford computer scientist and Verified Voting founder David Dill in an email to WIRED.<\/p>\n Voatz shared one white paper<\/a> with WIRED, but it lacks the kind of information experts might expect\u2014details on the system architecture, threat tests, how the system responds to specific attacks, verification from third parties. \u201cIn my opinion, anybody purporting to have securely and robustly applied blockchain technology to voting should have prepared a detailed analysis of how their system would respond to a long list of known threats that voting systems must respond to, and should have made their analysis public,\u201d Carnegie Mellon computer scientist David Eckhardt wrote in an email.<\/p>\n Ideally, experts say, Voatz would have held a public testing period of its app before deploying it in a live election. Back in 2010, for example, Washington, DC, was developing an open-source system for online voting and invited the public to try to hack the system in a mock trial. Researchers from the University of Michigan were able to compromise the election server in 48 hours and change all the vote tallies, according to their report afterward<\/a>. They also found evidence of foreign operatives already in the DC election server. This kind of testing is now considered best practice for any online voting implementation, according to Eckhardt. Voatz\u2019s trials have been in real primaries.<\/p>\n "West Virginia is handing over its votes to a mystery box."<\/p>\n David Dill, Stanford University<\/p>\n Voatz's use of blockchain itself does not inspire security experts, either, who dismissed it mostly as marketing. When asked for his thoughts on Voatz\u2019s blockchain technology, University of Michigan computer scientist Alex Halderman, who was part of the group that threat-tested the DC voting portal in 2010, sent WIRED a recent XKCD cartoon<\/a> about voting software. In the last panel, a stick figure with a microphone tells two software engineers, \u201cThey say they\u2019ve fixed it with something called \u2018blockchain.\u2019\u201d The engineers\u2019 response? \u201cAaaaa!!!\u201d \u201cWhatever they\u2019ve sold you, don\u2019t touch it.\u201d \u201cBury it in the desert.\u201d \u201cWear gloves.\u201d<\/p>\n \u201cVoting from an app on a mobile phone is as bad an idea as voting online from a computer,\u201d says Avi Rubin, technical director of the Information Security Institute at Johns Hopkins, who has studied electronic voting systems since 1997. \u201cThe fact that someone is throwing around the blockchain<\/em> buzzword does nothing to make this more secure. This is as bad an idea as there is.\u201d<\/p>\n Blockchain has its own limitations, and it\u2019s far from a perfect security solution for something like voting. First of all, information can be manipulated before it enters the chain. "In fact, there is an entire industry in viruses to manipulate cryptocurrency transactions before they enter the blockchain, and there is nothing to prevent the use of similar viruses to change the vote," says Poorvi Vora, a computer scientist and election security expert at George Washington University.<\/p>\n She adds that if the blockchain is a permissioned version, as Voatz\u2019s is, \u201cIt is possible for those maintaining the blockchain to collude to change the data, as well as to introduce denial of service type attacks.\u201d<\/p>\n Sawhney pushes back against this last critique, telling WIRED that the blockchain verifiers in the Voatz system is a collection of vetted stakeholders such as Voatz itself, election officials, nonprofit voting auditors, and politicians.<\/p>\n And even though the transaction is through an app rather than a browser, Vora says previously identified risks of internet voting remain. "Both the browser and the app run on the operating system underneath, and both, hence, inherit the vulnerabilities that go with relying entirely on software," she says.<\/p>\n Sawhney admits the concern about malware on a person\u2019s device is legitimate but thinks that creating a program to manipulate votes would be so hard as to be impractical. \u201cIt\u2019s theoretically possible, if that malware had been specifically written to intercept votes passing, to reverse-engineer our application, break all our keys, specifically modify if somebody marks oval A change it to oval B, and then bypass the identifier and send it to the network, but that is so, so hard to do in real time," he says. "It is possible, but we haven\u2019t found a way to do it.\u201d He adds that the app checks the phone for malware before downloading on a device, though he admits it could be possible for malware to go undetected.<\/p>\n The role of facial recognition in authenticating voter identities is another thing that concerns experts. Schneider worries that there could be ways to trick that technology using videos available elsewhere on the internet, for instance. And Vora notes that facial-recognition technology has known racial biases<\/a> that could affect who even is able to access Voatz.<\/p>\n Sawhney tells WIRED that Voatz has people manually check the facial-recognition authorization. This is possible at the moment but could become an issue if the technology were to be introduced to a wider electorate, as Voatz states on its website is the ultimate goal. In fact, Voatz has already encountered a scaling problem. When Utah GOP voters tried to use the app during their caucus in April, many couldn\u2019t get it to work. You can read about many voters\u2019 experience in bad reviews of Voatz they left in Apple\u2019s App Store. Sawhney tells WIRED that the issues stemmed from voters attempting to download the app and authenticate themselves minutes before polls closed, which didn\u2019t give Voatz enough time.<\/p>\n Though Voatz has answers for much of the criticism it has faced this week, none of its responses are likely to convince security experts that the smartphone voting app is ready for November. At the very least, the security world's reaction to Voatz underscores how important transparency is in the rollout of any new voting system. \u201cWest Virginia is handing over its votes to a mystery box,\u201d Dill says.<\/p>\n But election officials in West Virginia are enthusiastic about the app. \u201cThey used it in the primary in a couple of the other counties to do a test drive, and they said it was wonderful,\u201d says Kanawha County Clerk Vera McCormick, who oversees voting in the state capital of Charleston and plans to allow the 60 overseas military members registered in her county to use Voatz to vote. \u201cWe're excited and my understanding is the security is wonderful, so we'll find out.\u201d<\/p>\n