'Proceed very cautiously': Experts say WA online elections raise security concerns

Voting online is now an option for certain voters in King, Pierce, and Mason counties. But Washington state lawmakers and security experts say these methods should be "off the table" in 2020.

Tuesday, February 11 is the last day for voters in the King Conservation District election to submit their online ballots.

The election made headlines last month as the country’s first in which all eligible voters cast ballots via smartphones and computers. Pierce and Mason counties plan to use the same method to allow military and overseas voters to cast ballots in the presidential primary.

But the failure of the app at the Iowa caucuses last Monday has inflamed doubts around online voting. Even before then, Washington Secretary of State Kim Wyman and cybersecurity experts condemned online balloting calling for the exclusive use of paper ballots this year.

Should Washington voters worry about online voting?

Bradley Tusk, whose company Tusk Philanthropies has funded online election pilots in King, Pierce, and Mason Counties, defends his efforts as different from the technology at issue in Iowa. He said that while the Iowa app was developed in secrecy, he’s worked in partnership with elections administrators.

In a recent statement, Tusk said both paper ballots and the Iowa caucus app had shortcomings. “Paper ballots brought us hanging chads,” he said alluding to disputed ballots in the 2000 presidential election.

“We need to stop putting responsibility for our elections on the backs of party loyalists. And we need to ensure that every new idea is tested, transparent and secure,” as Tusk maintains his limited online voting pilots have been so far.

"A very weak system"

Computer scientist Jeremy Epstein has a much different perspective than Tusk. He argues the platforms Tusk has funded through two firms, Voatz and Democracy Live, are not transparent.

“Both Voatz and Democracy Live have talked about, ‘Oh yes we’ve had security assessments,’” said Epstein, who works for the Association for Computing Machinery. “But they won’t release any information on what they’ve tested, what the results are. They just said, ‘don’t worry, be happy.’”

Epstein said there are no standards for secure internet voting because it is “fundamentally insecure. " He add that "we don’t want to build standards for ‘safe cigarettes,’” and “we don’t build standards for ‘safe’ internet voting because it’s a contradiction in terms.”

Voatz developed the platform for military and overseas voters in Mason County in the upcoming presidential primary. Democracy Live developed the platform used in the King Conservation District and for Pierce County’s military and overseas voters.

Democracy Live CEO Bryan Finney said the online ballot offers a better alternative than returning ballots as e-mail attachments, something currently allowed under state law that most agree is not secure.

But Jesse Rothstein, chief technology officer of the cybersecurity firm ExtraHop, said the voting portal developed by Democracy Live for the King Conservation District has its own problems.

Disclosure: ExtraHop is an underwriter on KUOW

Rothstein noted that voters log in with their name and date of birth – information that is publicly available. Rothstein said there are ways to mitigate this, such as sending voters a unique code, "but the information that they’re requiring for this election is unfortunately a very weak system.”

After completing their online ballot, voters submit a written signature by signing with their mouse or finger on a smartphone — a step that Finney said is a security feature.

“In King County the security and the validation is based on the signature,” he said. King County Elections “is going to verify that signature matches and only if it matches is the ballot going to get processed for tabulation.”

Epstein, however, contends that voter signatures – which may look different when voters enter them into devices than they do on paper – aren’t much of a safeguard.

“I think the signature is a feel-good thing but it doesn’t actually do anything to prove who anybody is,” he said.

Rothstein said he’s concerned that online elections would be difficult to audit and could reveal voters’ identities.

“These systems are very difficult to secure, it’s very difficult to guarantee any sort of anonymity or chain or custody around the vote such that you have strong auditability,” he said. “I would proceed very cautiously if at all.”

He said while some advocates of online voting compare it to online banking, “There actually is a great deal of banking fraud that the industry absorbs every year in order to conduct business. But I think any amount of voter or election fraud can potentially call into question the results of an election,” Rothstein said.

WA state and county elections officials at odds

Washington Secretary of State Kim Wyman has said maintaining voter confidence is paramount this election year.

“There’s something to be said for being able to go back to a piece of paper that the voter submitted,” she said. “And when you get into an electronic world now we’re arguing over lines of code and electronic audit trails.”

She said that recounts in the 2004 governor’s race between Republican Dino Rossi and Democrat Christine Gregoire were fraught, even with paper ballots involved.

Wyman has proposed legislation that would eliminate ballot return by fax and email, which state law currently allows for military and overseas voters. For now, Wyman said she wants electronic ballots “taken off the table entirely. And this is where, full disclosure, my county partners do not agree with me on this.”

One of those partners is Pierce County Auditor Julie Anderson. She said military and overseas voters have specific needs that online voting helps address.

“There is no electronic return option that’s bulletproof,” she said. “What we have is a system that’s better than email. And every security expert and every election administrator agrees on that point.”

But Anderson said if Wyman is successful in changing state law, then Pierce County will curtail online voting.

“I’ve got several hundred military and overseas voters that are going to miss that option,” Anderson said. “I am very sympathetic to [Wyman's] point of view. And if the legislature agrees, then I won’t be looking for these alternate electronic return methods.”

Wyman said she could sue to stop a county from something she considered too risky, but she said she will continue to work closely with the counties using online voting, and they are currently “nowhere close to that scenario.”

King County Elections director Julie Wise recently told KUOW’s The Record that while the agency is assisting with the King Conservation District election, “King County elections has no intentions of moving forward with an app or online voting. "

Wise added that King County Elections "will continue to look and make sure we’re providing the best access for our voters,” especially those who are overseas or have disabilities. But in an earlier press statement, Wise called the conservation district election “a key step in moving toward electronic access and return for voters across the region.”

Tusk confronts online voting challenges

Bradley Tusk made clear he remains committed to online voting, which he said is the best way to increase voter turnout and participation.

Tusk runs a venture capital fund that invests “in high-growth startups facing political and regulatory challenges.” Now, his philanthropy is aimed at helping electronic voting overcome its own regulatory hurdles. A 2016 profile called Tusk “Silicon Valley’s political maneuvering expert.”

Sheila Nix, president of Tusk Philanthropies, said the organization funds the cost of developing the online ballot in jurisdictions that have run its pilot projects, like those in Washington state. Tusk recently told NPR that his goals are to fund dozens of online voting pilots and overcome critics’ skepticism about the method.

Overall, elections officials say voting online is a better option than returning ballots by email. And some believe it is well-suited to special populations, like overseas voters and people with disabilities. But in terms of privacy and security, they say, paper ballots still reign supreme.