In a Nov. 7 letter, Sen. Ron Wyden, D-Ore., urged Secretary of Defense Mark Esper and National Security Agency (NSA) Director Gen. Paul Nakasone to conduct a cybersecurity audit of mobile voting app Voatz to “determine whether it can reliably protect the votes of U.S. servicemembers against foreign hacking.”
The app, which first gained traction in 2018 in West Virginia, gives military and overseas voters the ability to vote via the internet. The app has since spread and localities in Colorado, Utah, and Oregon have begun pilot programs to test the app.
In a Nov. 9 statement, Voatz said that it “welcome[s] any and all additional security audits by the Department of Defense and NSA regarding our platform.”
While Wyden acknowledged the importance of making it easier for service members and overseas citizens to vote, he did say he was “very concerned about the significant security risks associated with voting over the internet.”
Wyden specifically called into question Voatz’s ability to audit itself, “While Voatz claims to have hired independent experts to audit the company, its servers, and its app, it has yet to publish or release the results of those audits or any other cybersecurity assessments.” He further argued that because Voatz won’t identify its auditors, “this level of secrecy hardly inspires confidence.”
In response to Wyden’s charges of undue secrecy, Voatz cited the importance of protecting its intellectual property, but said it remains “committed to providing as much transparency as possible about our system.”
In his push to have Esper and Nakasone launch an audit, Wyden noted that both men signed a statement last week saying that “Russia, China, Iran, and other foreign malicious actors all will seek to interfere in the voting process.” With that in mind, Wyden said that “Given your shared interest in protecting service members and their votes from foreign hacking, I urge you to conduct a cybersecurity audit of Voatz.” He further urged that the eventual audit report be publicized so that state and local officials can make informed decisions about whether to deploy the app.
Voatz said that it is “confident that all additional audits will come to the same conclusions that the West Virginia Secretary of State’s office, the Denver Elections Division, the Utah County Elections Office and independent security organizations such as ShiftState Security have: that all our elections to date have been conducted safely and securely, with no reported issues with the accurate tabulation and recording of ballots, and that the overall system is very robust.”
