Voting in the pandemic: Why mobile applications are not the answer – yet
- By Brent Hansen
- Apr 16, 2020
As we all sit together in isolation, it seems only natural to begin to ask the question of how voting for public office will take place across the U.S. The prevailing sentiment indicates that some type of new online system in place of in-person or current absentee methods may offer a solution.
Popular media is giving voice to opinions from election officials and political leaders that some extraordinary measures must be taken to ensure elections can continue despite shelter-in-place directives. These opinions are tempered with the acknowledgement that such extraordinary measures must have equally extraordinary security safeguards to protect both the integrity of the votes and the personal information of the voters. That’s sensible, but at the same time we must acknowledge that mobile application safeguards are not yet ready.
Every system is hackable for those who have the combination to unlock it. From there it’s a short hop to stealing that information and selling identities on the Dark Web. That in turn creates a potentially fertile environment for data manipulation – whether influencing the population by sowing misleading information on social media or by creating false election outcomes. It doesn't take much data manipulation to do that -- especially in very close elections at the district or state level, but the risk extends even to the presidential contest. A couple of numbers changed here and there, or a bit falsified trending information, can make an enormous difference.
Consider the current systems in place for vote tallying and reporting -- they're long overdue for a drastic overhaul. The only true way to run an election and mitigate the risk of being compromised is to use paper ballets with some kind of system of record such as scanning devices to tally up votes.
If we are to heed the call for online elections, to move voting applications to mobile devices, we must acknowledge there’s no definite way to secure those applications. Even sole-sourced app development can be compromised by one insider who puts a back door in the software. How can a vote be secured from the check box all the way to where it's tallied and stored?
We’re talking about a 360-degree view of the lifecycle of a piece of data. How can states protect the data flow without gaps? That’s essential, because when even one gap is introduced, officials will begin to lose some understanding of when they may be under attack.
The answer is still wildly under debate, but several requirements are certain:
- A way to authenticate the user or to authenticate a valid voter. That certainly protects from data manipulation out of the gate.
- The ability to do real-time analysis based on data growth, which, of course, necessitates protecting data collected in either a database or in an application.
- Protection and hardening of the data against insider threats, malware or an unpatched operating system that might spring a leak. Data must be hardened from a sole source that may be writing and/or reading the data.
- Protection of data downstream to where votes are tallied and finally reported, all the way to its ultimate destruction or disposition.
And finally, agencies must stay away from the “easy button,” which is mobile applications. They should not be tempted to create a mobile application for voting.
We do not yet have the capability to lock down voting applications with assured authentication, no matter how simple. We’ve already experienced enough problems in this year’s primaries, with user confusion and concerns about access across devices and various versions of patches on the range of mobile operating systems. Secure voting requires something less fluid than a mobile application.
As we move forward into an uncertain future, it is absolutely time to re-evaluate our current voting systems, update aging systems and create new methods that take advantage of the power offered by the internet. In the near term, however, mobile applications are not ready to take on the security challenges inherent in voting.
Brent Hansen is federal CTO of Thales Trusted Cyber Technologies.