There are concerns that the COVID-19 pandemic will discourage voters from turning out to vote in person for this year’s U.S. presidential primaries and general election. State governments are considering alternative voting processes to protect voters and election officials from infection at the polls.
As strange as it may sound coming from a CTO, I advise that they utilize vote-by-paper ballots rather than rush to implement a website or mobile app-based voting system. This has as much to do with the lack of resources and technical expertise of local governments as it does with the lack of confidence voters will have in digital-online voting.
Paper ballots are the most trustworthy voting technology because it is difficult to manipulate them at scale. On the other hand, digital voting through a website or a mobile app brings with it not only the possibility of user error, but also the possibility that a cyber campaign using malware or other techniques could manipulate or change citizens’ votes at scale with greater ease.
Some of the techniques that malware uses today, such as in banking fraud, allows the user to type in their credentials (or their authorization key) and makes it look like the user performed the transaction that they intended. With the user’s credentials or transaction code, the malware could perform a different transaction, such as transferring funds to the attacker’s account.
This same issue is present in a voting application or website. The voter could cast a vote, it would appear to reflect their intended selections, but the vote actually sent to the backend could go to the other candidate.
Unlike a banking application where the user would eventually see the fraudulent transaction in their account statement, in an election, the only result would be the total vote count, and it would not be obvious that a manipulation had occurred. Even national-ID or smartcard credentials don’t help in this type of attack, given that the attack occurs after the user has authenticated to the back-end system.
Additionally, wherever voting machines are used, there must be a paper record or receipt of votes cast to enable election officials to audit their election vote counts. This also enables the voters to have proof their vote was recorded properly.
Some may argue that malicious actors could attempt a counterfeit paper ballot fraud at scale, but the fact is that many states have already established anti-counterfeit paper ballot design standards to counter such efforts. The best of these practices should be adopted wherever the paper ballot becomes the standard voting mechanism in 2020.
Others may argue that a fully digital voting process will protect election board processors that might otherwise contract coronavirus from tabulating the paper ballot votes. But a recent study cited by CDC asserts that the virus can survive on paper or cardboard for only 24 hours. If the U.S. or other countries decided to go to a pure paper ballot format, election officials could either have voters send their ballots through the United States Postal Service or set up drive-through stations where voters could simply walk or drive by and drop their ballots through a submission slot themselves. Then the processors could augment basic protective measures such as wearing gloves with an extra time delay of 24 hours from receipt to minimize risk of transmission.
Another consideration is that local election officials are challenged in securing the basic information systems for voting, such as the websites with information about election process. McAfee’s recent analysis of U.S. local government election security practices showed that 83.3% of battleground state election websites were not using .gov domains and 46.6% were not using https security. It’s unreasonable to assume that a high integrity digital voting system can be developed in a few months when even the basic cyber hygiene practices are lacking in existing election systems.
Technology should certainly be used in the automation of scanning and recording the votes of paper ballots, as those systems are well proven and leave election administrators a paper record that allows them to audit and verify that there is no manipulation.
Finally, we must make sure that every voter has the ability to vote. Where appropriate, states and local governments need to relax the criteria for remote voting to allow all eligible voters in the country to vote by mail.
In times of a global pandemic, the trust of the public in its government is more critical than ever. Paper may be a 2,000-year-old technology, but ordinary citizens understand and trust paper. Voters must have faith that their vote will be counted and honored. Given that there are increasing levels of inherent distrust in political systems, we must use the technology that is a trusted common denominator by the broadest swath of the electorate. Ironically, paper is that technology in 2020.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
