Social distancing will change elections. Here’s how we can secure them.

No matter how you slice it, one of the biggest disagreements Americans will have this election won’t be over political platforms, but over how to hold the election itself. While it’s near impossible for the entire country to completely eliminate in-person voting come fall, the majority of people likely will vote differently than they have in the past.

This means virtual voting may have its moment in the sun in November. While not an alien concept by any means, it does come with potential security risks. Whether states and local governments can pull off a virtual program successfully may largely depend on the technology’s ability to validate and track every vote while simultaneously maintaining the trust of constituents. 

Securing the digital vote

Digital voting hasn’t been adopted by nearly as many states as its mail-in counterpart. Nineteen states do not allow electronic transmission at all, meaning voters must return voted ballots via postal mail. But four states-- Arizona, Colorado, Missouri and North Dakota -- allow some voters to return ballots using a web-based portal, West Virginia has offered a mobile voting application using blockchain technology in the past and several others allow some voters to return ballots via email or fax.

Before the nation was hit with COVID-19, cybersecurity experts agreed that mixing the internet and voting was a bad idea. But that conversation has changed in the face of a global pandemic. Digital voting might be one of just a few ways to guarantee a fair democratic process.

It’s not like some states weren’t headed in this direction already. For example, Utah County, Utah, and the city of Denver are both piloting a mobile app for military and overseas workers that leverages blockchain. Perhaps the sudden need for an at-home, virtual voting method prompted by social-distancing mandates is an opportunity to push both the political and cybersecurity communities out of their comfort zones.

Although digital voting methods could be useful, the right security components must fall into place because security cannot be compromised for functionality. As with mail-in voting, a state’s ability to verify the identity of each voter and guarantee traceability of a vote will be the key to thwarting voter fraud. This can be accomplished by:

• Voter identity management: Mobile voting applications must create an equivalence between online identity and physical voter management. Similar to tax or banking sites that take several steps to verify an individual’s identity during a high-touch transaction, digital voting must include multi-factor authentication and extensive user privilege management.
• Ballot traceability: Tabulation must be traceable from the individual to the device from which the vote came so as to afford clear registration, tabulation, recount and analysis. 
• Exhaustive trials: While we’re only about six months out from Election Day, states should be running mock elections to iron out potential pitfalls in a virtual election process. This is uncharted territory for many districts. The worst time to discover risks is during a live election, so it’s best to identify those ahead of go-live-time as much as possible.
• Remembering the human element: While digital voting programs would require fewer human resources than the mail-in process, states will still rely heavily on staff for overall quality assurance. In a digital voting scenario, these personnel would be working entirely online, so  campaigns should consider using User and Entity Behavior Analysis (UEBA) to detect anomalous authentications. By monitoring staffers’ behaviors and detecting anomalies from their typical workflows, IT teams would be able to reduce the impact of threats introduced through social engineering, phishing and other malicious techniques. This method can be used to detect voter anomalies as well.
• Broaden the vendor market: There are only a handful of digital voting vendors in business today, which adds a layer of concern from a security standpoint. If bad actors wanted to impede elections, they would have a shallow plate of prey. The federal government may pass another COVID-19 recovery bill that would put more budget into states’ election programs. If the country wants to take digital voting possibilities seriously, it would be wise for those funds to go toward developing more applications to facilitate mobile and online voting. After all, the changes to voting procedures in November will change how Americans cast their ballots long past 2020.

A necessary burden

To have an election that is fair, free, fast and safe for everyone this year, at-home alternatives must be made available to all voters. That means voting officials must make accommodations and decisions under already-tight deadlines and general uncertainty. Needless to say, much weighs on the shoulders of the government security community right now.

To prepare for an at-home election, the public sector must learn the lessons from past virtual endeavors and must keep security a top priority. Americans must be sure that their voice is heard in the impending race. Preparedness, readiness and trust will be key factors moving into Election Day. It’s up to security professionals to make the changes necessary in order to ensure a fair and accessible election for everyone.