As online voting becomes more popular, election security experts raise an alarm

Editor's note: This story has been updated to remove mention of Democracy Live, a voting technology firm.

While voting with your phone may seem like a reasonable feat in an era of online banking and mobile stock trading — there's even bipartisan congressional support for certain uses — many significant security and privacy issues remain unresolved.

Mobile voting has been studied and tested for two decades, and election security experts have repeatedly found vulnerabilities with such a system. Still, figuring out a way to safely and anonymously cast a ballot online remains a priority for some voting technology enthusiasts.

l Until such a system is achieved, though, election security experts are strongly advising Congress to pump the brakes on a proposed Defense Department policy bill that includes funding for online voting. A group of 31 election security experts and organizations sent a letter last week warning lawmakers about "serious and unsolved security vulnerabilities" with electronic ballot return.

But they may be facing strong headwinds, as online voting gains steam.

Online voting gains popularity and financial support

Acting under the authority of the Uniformed and Overseas Citizens Absentee Voting Act, 31 states and Washington, D.C., allow military and civilian overseas voters — as well as disabled voters in some jurisdictions — to return absentee ballots electronically, according to the National Conference for State Legislatures. States vary on whether they permit returns via an online portal, mobile app, email or fax. Every state allows absentee ballots to be returned by mail and in person.

In last year's election, roughly one-third of overseas military and civilian voters returned their ballots through some kind of electronic method, according to a post-election report prepared by the Election Assistance Commission.

Online voting has gained popularity in recent years as more researchers have studied its feasibility. One prominent proponent of mobile voting is billionaire philanthropist Bradley Tusk. In 2017, his nonprofit, Tusk Philanthropies, launched a mobile voting campaign with pilot programs across seven states.

Most recently, Tusk Philanthropies announced a $10 million grant program at the end of September, to fund the development of a new, end-to-end verifiable internet voting system. The goal of this program is to provide more accessible voting options for military and overseas civilian voters, disabled individuals and other voters encountering barriers to traditional voting.

"Despite past efforts to remove barriers to voting for our military service members, it is clear that they still face tremendous obstacles to voting," Tusk Philanthropies said in a statement.

Less than half (47 percent) of active duty military service members participated in the 2020 election, which is on par with the 2016 voter turnout rate, according to the Federal Voting Assistance Program.

"Given where technology is today, we need to accept and acknowledge that mobile voting is gradually becoming more common across U.S. elections," Tusk Philanthropies said. "Instead of offering the same solutions to these problems, we should be focused on doing everything we can to find additional ways for military voters to both access and return their ballots."

The National Defense Authorization Act for fiscal 2022 , which approves DOD policies and funding, includes two provisions that would fund the electronic transmission of absentee ballots for overseas military and civilian voters. The legislation was passed by the House last month and is now being considered in the Senate.

One provision instructs the Defense Department to develop a plan for providing end-to-end electronic voting services, including registering to vote, requesting a ballot, completing a ballot and returning a ballot.

The second mobile voting provision funds a pilot program to bring ballot security in line with existing federal cybersecurity guidelines, using cloud and blockchain solutions.

The risks of online voting

While Tusk Philanthropies said the legislation is a "much-needed step forward to help ensure our military has full access to voting," election security specialists strongly disagree. In their letter to Congress, the 31 experts argued against funding for internet voting because it is "not safe or secure, and will undermine confidence and trust in elections."

Online voting in governmental elections has been "rejected as unacceptably insecure" by the FBI, the Department of Homeland Security, the National Institute for Science and Technology, the Senate Intelligence Committee, and the National Academies of Science, Engineering and Medicine, the letter states.

Even with security tools such as end-to-end verification, encryption, cloud-based services and blockchain, mobile voting faces high security risks, experts warn.

One of the basic problems with mobile voting is that it relies on the internet, which is fundamentally insecure, said Susan Greenhalgh, senior advisor on election security at Free Speech for People, one of the groups that signed the letter.

"That's why even banks that have billions of dollars to spend on their security budgets still end up getting hacked," she said. "[Banks] have much greater resources than our election administrators do, so that is evidence and speaks to the fact that when the internet was developed, it wasn't developed for security, it was developed for accessibility."

Another major concern with mobile voting is privacy violations. While personal identity is a core component of banking security, the opposite is true for voting. There is no mechanism to report and correct online voting errors without revealing the voter's identity and breaching the secret ballot.

Authenticating a voter's identity over the internet is also difficult. And because voters would use their own devices to cast a ballot online, it's essentially impossible to guarantee no malware or other vulnerabilities exist, even if election officials have security measures built in on their end.

"We already know from the 2016 election and from the 2020 election that our elections are an international target. This is a national security issue. You have our soldiers, men and women fighting overseas to protect our national security, so that we can preserve our democracy and here's this system that's being touted that will specifically undermine it, said Susannah Goodman, director of the election security program at Common Cause, another group that signed the letter.

Election security experts expressed concern about anything that could lead to further distrust in American elections, especially after last year's contentious presidential race.

"It's not just that [military service members'] ballots could be compromised, it's that the election will be compromised. The democracy that they are there to protect can be compromised, and it introduces doubt," Goodman added.

Because the government has not yet found a way to develop standards to make online voting secure, there's no federal certification for online voting vendors, leaving these companies "completely unregulated," Greenhalgh said.

This had led to vendors "pitching their systems to state and local officials with potentially false, misleading and/or deceptive marketing claims," Greenhalgh wrote in a June reportproduced by Free Speech for People.

"This is a problem in that we have this unregulated market and the vendors can say what they want to say and there's very little repercussion," Greenhalgh said.

The experts argue that instead of expanding risky online voting technology, there are better solutions for improving accessibility for military and overseas civilian voters, experts wrote in the letter. They recommend:

• Implementing automatic voter registration for eligible members of the military.
• Automatically sending absentee ballots to registered military members.
• Offering expedited and free postage for mail ballot returns.
• Improving ballot tracking services.
• Extending deadlines for the return of absentee ballots from military voters.

"We believe that servicemembers deserve the highest standard of safe and verifiable voting," the letter states. "For the foreseeable future, internet voting cannot meet that standard, and places military voters' votes — and the trustworthiness of elections themselves — at risk."