While the 2020 election cycle has been officially underway for less than a month, there have already been significant technology concerns. While the most notable tech concern was the Feb. 3 Iowa Caucus, researchers at the Massachusetts Institute of Technology (MIT) raised additional concerns in a report published Feb. 13.
The report identified security vulnerabilities in Voatz, a voting app being used by multiple states to enable voting via smartphones. Specifically, MIT researchers say that hackers could compromise the app to alter individual apps and there are privacy issues for users.
Voatz was initially used by West Virginia in the 2018 midterm elections as a way to let West Virginians living abroad more easily cast their vote. Since then, West Virginia has expanded its use to improve access to voting for residents with disabilities and Denver, Utah, and Oregon have begun using the app.
This is not the first time Voatz has come under scrutiny for security and privacy concerns. In a Nov. 7 letter, Sen. Ron Wyden, D-Ore., urged Secretary of Defense Mark Esper and National Security Agency (NSA) Director Gen. Paul Nakasone to conduct a cybersecurity audit of mobile voting app Voatz to “determine whether it can reliably protect the votes of U.S. servicemembers against foreign hacking.”
Researchers pinpointed a number of security and privacy vulnerabilities during West Virginia’s use of the app in 2018, including the “opportunity for hackers to alter, stop, or expose how an individual user has voted.”
The report explained, “Perhaps most alarmingly, we found that a passive network adversary, like your internet service provider, or someone nearby you if you’re on unencrypted Wi-Fi, could detect which way you voted in some configurations of the election. Worse, more aggressive attackers could potentially detect which way you’re going to vote and then stop the connection based on that alone.”
The report also found that “Voatz’s use of a third-party vendor for voter identification and verification poses potential privacy issues for users.”
“Though Voatz’s privacy policy does talk about sending some information to third parties, as far as we can tell the fact that any third party is getting the voter’s driver’s license and selfie isn’t explicitly mentioned,” noted report author Michael Specter, a graduate student in MIT’s Department of Electrical Engineering and Computer Science (EECS) and a member of MIT’s Internet Policy Research Initiative.
MIT noted that after discovering the security vulnerabilities, researchers disclosed their findings to the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA). MIT than worked with CISA to ensure that impacted elections officials and the vendor were aware of the findings before the research was made public.
The researchers said that their findings “underscore the need for transparency in the design of voting systems, according to the researchers.” In contrast to election processes that use paper ballots – which are designed to be transparent – and allow political party representatives to observe the voting process, the Voatz app doesn’t have a similar transparency mechanism. “Voatz’s app and infrastructure were completely closed-source; we were only able to get access to the app itself,” said report author James Koppel, a graduate student at MIT’s Department of EECS.
Specter agreed and expanded on Koppel’s point, “The biggest issue is transparency,” says Specter. “When you have part of the election that is opaque, that is not viewable, that is not public, that has some sort of proprietary component, that part of the system is inherently suspect and needs to be put under a lot of scrutiny.”
As to what this means for smartphone-based voting, Koppel said that voting over the internet is not a secure, viable option.
“The consensus of security experts is that running a secure election over the internet is not possible today,” adds Koppel. “The reasoning is that weaknesses anywhere in a large chain can give an adversary undue influence over an election, and today’s software is shaky enough that the existence of unknown exploitable flaws is too great a risk to take.”
Acknowledging the potential of app based-voting to improve access to the ballot box, Daniel Weitzner, a principal research scientist at MIT’s Computer Science and Artificial Intelligence Lab (CSAIL); founding director of the Internet Policy Research Initiative; and author of the report, said that “in order to maintain trust in our elections system, we must assure that voting systems meet the high technical and operation security standards before they are put in the field.” He stressed, “We cannot experiment on our democracy.”
