Absentee voting today and tomorrow

Online voting might be the Holy Grail of participatory democracy, but like the Holy Grail, it has proved elusive. Until technical standards are developed, the Defense Department is instead using a patchwork of high-, low- and mid-tech tools to link overseas personnel with their local election officials. Next month, those tools will yield benefits.DOD actually shelved plans for an expanded online voting pilot in 2004 despite a successful test of the technology by the Federal Voting Assistance Program during the 2000 presidential election. 'It was a proof of concept, and we saw it could be done,' FVAP deputy director Scott Wiedmann said of the 2000 Voting Over the Internet test.The original experiment was to be followed by the Secure Electronic Registration and Voting Experiment in 2004, but deputy Defense secretary Paul Wolfowitz pulled the plug because of concerns about the inherent insecurity of the Internet.The National Institute of Standards and Technology, with the help of the federal Election Assistance Commission, is now developing standards for Internet voting to help ensure adequate security. When those are ready, FVAP will give online voting for overseas personnel another try, Wiedmann said.In the meantime, military personnel away from home'whether in or outside the United States'and civilians living overseas can use more tried-and-true tools for getting absentee ballots, including postal mail (or 'bymail'), e-mail and faxes.FVAP administers the Uniformed and Overseas Citizens Absentee Voting Act of 1986.The program office does not handle the casting or counting of ballots, but is a middleman, enabling movement of documents between absentee voters and local election officials. The job is complicated by the fact that FVAP has no say in local voting requirements or any control over the technology available to election officials or remote voters.'Bymail has been used since the Civil War' for absentee voting, Wiedmann said. 'It is still the primary method.'But with voters scattered around the world, postal mail, too, is a chancy method of delivering and returning absentee ballots, often disenfranchising voters by missing critical deadlines.In 1990, for mid-term elections held during the first Gulf War, FVAP set up fax stations for troops in the field so they could request and return ballots over the DOD switched network. Some 500 votes were cast this way.'In 1990, faxing still was somewhat new,' Wiedmann said. Most states accepted the faxed ballots on an ad-hoc basis, without laws specifically allowing their use.Today, 50 states and territories have laws allowing overseas voters to request ballots by fax through FVAP, 35 allow blank ballots to be sent out by fax and 26 allow voted ballots to be faxed back.But in 2003, some Mississippi National Guard troops in Iraq did not have access to fax machines during their gubernatorial election. They did have access to e-mail, however, so FVAP retrofitted its system to convert faxed ballots to PDF files that could be e-mailed to troops, printed, scanned back into PDF files and e-mailed to FVAP, where they were printed out and faxed back to the Mississippi office.At the time only about a dozen votes were cast that way, but it provided an alternative to mail. 'We have kept that feature up and running,' Wiedmann said. It's now used in several other states.In 2004, the Interim Voting Assistance System was formally fielded to provide a secure link between voters and local election officials (it was extended in this year's supplemental DOD spending bill and relaunched last month as the Integrated Voting Alternative Site). It uses secure FVAP servers for the exchange of PDF applications and ballots.[IMGCAP(2)]PostX Corp. of Cupertino, Calif., manages IVAS, which is built on its secure messaging platform and hosted by a third party at a secure data center in the Washington area. Using DOD digital certificates and public-key infrastructure, voters log onto a secure Web server to fill out an electronic federal application form for an absentee ballot. The completed form is then uploaded to the appropriate local election office, where authorized officials can access it.When the request is approved, local officials upload an electronic ballot package and notify the voter by e-mail that it's available for download.'They can print that out, and from that point the electronic part is pretty much done,' said Scott Olechowski, PostX VP of product development and strategy.IVAS does not handle the voting end of the process; the ballot must still be filled out and mailed to the election office. And although local election offices access IVAS, the system is not integrated with the local offices.'There is something like 70,000 local election offices, and they all have their own practices,' Olechowski said. 'What happens on the backside is going to be different and unique to each of them.'Local jurisdictions are in the process of signing up with IVAS so that they can upload ballots to remote voters.Eventually the next leap in serving remote voters might still be online voting, but when it will become practical still is an unknown. FVAP's 2000 Internet voting pilot was a limited program, with just 84 voters from Florida, South Carolina, Texas and Utah, but it demonstrated the strengths and weaknesses of the concept.It used DOD digital certificates and PKI to deliver encrypted ballots to the voters and return them to election offices. Users had to be issued certificates and had to load software for a Netscape Navigator browser plug-in on a networked computer.'Within a small-scale, tightly controlled demonstration, the risks introduced by the technology can be sufficiently mitigated to maintain the integrity of the process for remote registration and voting,' FVAP concluded in an after-action report.But the logistical and security challenges in scaling the system up to accommodate thousands of voters were daunting. DOD typically enforces tight configuration requirements on its PCs, and some voters were not allowed to use the Netscape browser or install the plug-in. But the most serious concerns were the security of the voters' personal computers and the Internet infrastructure that FVAP does not control.'For the VOI Pilot, security at the citizen workstation was considered a minor issue,' FVAP concluded. But in a widespread deployment it would become a major concern.Another concern is hackers. The 2000 pilot received little publicity and flew under hackers' radar. 'A larger-scale pilot will result in more visibility and potentially attract those with malicious intent,' FVAP warned.All these concerns were being addressed in the Secure Electronic Registration and Voting Experiment of 2004, in which as many as 100,000 voters from 50 counties would have cast votes. But when four members of a 10-member Security Peer Review Group evaluating the system issued a minority report questioning the maturity of Internet security, SERVE was shelved.For now, the word on Internet voting remains what FVAP concludes after the 2000 pilot: 'Clearly, Internet voting standards must be developed to allow the further use of Internet voting systems.'