The research described in this report was conducted to inform the project planning and execution of the Department of Defense's previously mandated electronic voting demonstration requirement. In the National Defense Authorization Act for Fiscal Year 2015, Congress eliminated this requirement and DoD is no longer exploring program implementation in this area. However, we believe the research and identification of outstanding questions are valuable and should be shared with the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) stakeholder community. Much of the supporting research may hold value for any future deliberations on the merits of remote electronic voting.
FVAP Final Report on the Electronic Voting Demonstration Project
This report explains the context of the research associated with the electronic voting demonstration project, and discusses the scope and purpose of the research, its limitations, conclusions and recommendations.
The FVAP Statement on Research Reports Related to UOCAVA System Testing explains the context of the research as it relates to FVAP's previously mandated electronic voting demonstration project. It discusses the scope and purpose of the research, its limitations, conclusions and recommendations.
This report describes a 2010 research effort to help inform FVAP's previously mandated electronic voting demonstration project. The VSTL testing was conducted to gauge the sufficiency of the Election Assistance Commission's Uniformed and Overseas Citizens Absentee Voting Act Pilot Program Testing Requirements and evaluate the quality of testing across VSTLs.
This report describes a 2011 research effort to help inform FVAP's previously mandated electronic voting demonstration project. It describes penetration testing of three voting systems. It is important to note the tests were only intended to serve as a proof-of-concept for the establishment of a model design and methodology for future penetration testing.
In this report, we examine the future of voting and the possibility of conducting secure elections online. Specifically, we explore whether End-to-End Verifiable Internet Voting (E2E-VIV) systems are a viable and responsible alternative to traditional election systems.
Scientists and security experts have documented a number of potential vulnerabilities facing any internet voting platform, including malware and denial of service attacks; voter authentication; ballot protection and anonymization; and how disputed ballots are handled. The lack of a meaningful voter-verified paper record means there is not way to conduct a valid audit of the results. Voting apps and online voting also threaten the secrecy of ballots and the anonymity of voters, bedrock principles of our democracy. Online voting is simply not secure, nor will it be in the foreseeable future. 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
Counties in several states, including West Virginia, Utah and Colorado conducted pilots of the online voting app Voatz as a means for overseas voters, including military personnel, to vote in their home state. Some states announced they intend to use a tool from Democracy Live in 2020. But the risks of online voting are well documented by computer scientists. Over two decades of research have detailed the challenges inherent in creating a secure, secret and verifiable system for voting.3, 7
In May 2020, the FBI, Election Assistance Commission, National Institute of Standards and Technology, and Department of Homeland Security's Cybersecurity and Infrastructure Security Agency warned states that the return of marked ballots online was "high risk." The threat assessment of electronic ballot delivery, marking and return addresses online voting technologies such as Voatz and Democracy Live.
A 2015 report by the U.S. Vote Foundation warned that no current Internet voting system is sufficiently secure and reliable for use in public elections.4 In 2018, a joint report from the National Election Defense Coalition, R Street Institute, Association for Computing Machinery US Technology Policy Committee, and Common Cause provided additional cautionary warnings against the validity and security of online voting, citing many of the concerns as the earlier reports. 2
Federal researchers agree that secure internet voting is not yet feasible.12 The Department of Defense suspended an Internet voting trial after concluding it could not ensure the legitimacy of votes cast over the Internet 13 and the Pentagon has stated it does not endorse the electronic return of voted ballots.14 Although the Department of Homeland Security has not published formal guidance on Internet voting, the Homeland Security cyber-division does not recommend the adoption of online voting for any level of government.14, 15
Through field research and coalition building, the RR/CC has pioneered a voter-centered approach to voting system design and development. Voting.REIMAGINED.An innovative voter-centered approach to voting for Los Angeles CountyThe Voting Solutions for All People (VSAP) was developed by the Registrar-Recorder/County Clerk (RR/CC) in 2009 to address an aging voting system and an increasingly large and complex electorate. The project seeks a collaborative approach to voting system design that will put voters at the center and maximize stakeholder participation.
This year, remote e-voting will be used in six Russian regions, including Moscow, according to the CEC. The Commission will examine nine applications from regions (other than Moscow) that wish to participate in the pilot project. Nationwide e-voting might be introduced as soon as 2024, when the next presidential election is supposed to take place. So, this year's online elections should be seen as a further step towards the digitalization of Russia's elections, which started two years ago.
Remote e-voting was tested for the first time in 2019 at the election of deputies to the Moscow City Council. The following year, during the all-Russia vote on constitutional amendments which took place from June 25 to July 1, 2020, residents of Moscow and the Nizhny Novgorod region were able to cast their votes electronically. Thus, in September 2020, online voting was tested in the pre-election to the State Duma in the Kursk and Yaroslavl regions.
However, the Kremlin's ever tighter grip over the internet and ICT, as well as the regime's increased power in managing elections and keeping control over ballot access, raise concerns that technology will be misused to achieve the desired results rather than properly serve voters. What's more, independent IT experts warn that using blockchain technology can change election results in ways that are "undetectable, or, even if detected, would be irreparable without running a whole new election"; the technology still has serious security vulnerabilities that could undermine the integrity of the election system. An opaque expert group that advises the CIK RF on the new technology and the lack of transparent monitoring procedures raises additional mistrust towards the new online voting.
Despite the aforementioned promise of the developers, the use of technology developed by Moscow's Department of Information Technologies together with Kaspersky Lab in the elections to the Moscow City Council 2019 revealed several major problems. The private key for decoding the votes was easily accessible online and made it possible to track how people voted. Moreover, independent observers noticed significant differences between the offline results and those submitted electronically in favor of candidates supported by the ruling party; a very limited possibility of technical control by observers and cases of violation of voting secrecy and coercion to vote.
So, during the all-Russia vote in 2020, the blockchain system created by Kaspersky Lab revealed several weaknesses. The website for online voting went offline in the first minutes after the start of voting. The passport data of voters was not sufficiently protected and was available online which showed that some voters were recorded in the system twice while others were able to vote with invalid passports. Moreover, people were able to vote twice, at polling stations and then through the online system.
In addition to these issues, the whole online voting system in Russia could hardly be seen as decentralized: voting takes place through state servers by registering accounts on the state portal such as Gosuslugi (or mos.ru in Moscow) and the blockchain network is controlled by the authorities or state-backed companies.
Electronic voting in Estonia gained popularity in 2001 with the "e-minded" coalition government. In 2005, it became the first nation to hold legally binding general elections over the Internet with their pilot project for municipal elections.[1] Estonian election officials declared the electronic voting system a success and found that it withstood the test of real-world use.[2]
Despite praise from Estonian election officials, computer security experts from outside the country who have reviewed the system have criticized it, warning that any voting system which transmits ballots electronically cannot be secure.[15] This criticism was underscored in May 2014, when a team of international computer security experts released their examination of the system, claiming they could breach the system, change votes and vote totals, and erase all evidence of their actions if they were to install malware on Estonian election servers.[16] The team advised the Estonian government to halt all online voting because of the potential threats that it posed to their government.
The Estonian National Electoral Committee reviewed the concerns and published a response, saying that the claims "give us no reason to suspend online balloting". The purported vulnerabilities were said to be either infeasible in reality or already accounted for in the design of the e-voting system.[17] The Estonian Information System Authority also responded to the claims, describing them as a political, rather than technical, attack on the e-voting system, and criticizing the method of disclosure.[18] The researchers' connection to the Estonian Centre Party, which has long been critical of e-voting, has also been a common speculation among Estonian state officials and has been even suggested by a prime minister.[19][20][21]
aa06259810