Delaware briefly deployed a controversial internet voting system recently but scrapped it amid concerns about security and public confidence.
Before the online option was shuttered, voters returned more than 2,700 ballots electronically — and those votes still will be counted, according to the state, along with conventional votes in the upcoming July primary.
Delaware Election Commissioner Anthony Albence said the decision to stop using the cloud-based return option was made to protect public perception of the election.
"We have had no problems with the system," said Albence. "We have confidence in the system, but we want everyone to be fully confident in anything that we do."
The coronavirus pandemic has sent election officials nationwide scrambling for creative solutions to voting problems this year, but it's becoming clear that there remains very little appetite for new internet voting platforms as part of that conversation.
After NPR reported in April that three states were moving toward statewide pilot programs to allow voters with disabilities to return their ballots over the internet, two of those states have since backed away from those plans after intense criticism from the cybersecurity community.
After an initial period in which it was active, Delaware now has ceased using the system for its upcoming primary, state officials confirmed to Delaware Public Media and NPR, although an internet return option via email is still available.
Officials also confirmed that the online voting options have essentially been offered to all registered voters in the state, not just those with disabilities — a fact that has not previously been widely reported, and one that may further trouble the security experts who are terrified about the prospect of widespread internet voting.
Online ballot return
The system, which was offered by the Seattle-based voting technology company Democracy Live, allows voters to mark their ballots through a web portal and then upload them to a cloud accessed by election administrators, who print them out and count them.
It's a voting method that the federal government recently warned states was considered a "high-risk" endeavor.
Earlier this month, security researchers from the Massachusetts Institute of Technology and the University of Michigan also released an analysis of the Democracy Live system that said it "represents a severe risk to election security" and found it to be "vulnerable to vote manipulation."
"There isn't any way for voters, Democracy Live or even election officials to confirm for sure that the vote [a] voter tries to cast is the same as what's received and counted by election officials," said University of Michigan researcher J. Alex Halderman, one of the authors, in an interview Tuesday.
In addition to Delaware's decision, New Jersey also is no longer piloting the electronic ballot return option for that state's July primary, after offering it to voters with disabilities in the state's May municipal elections.
In both cases, state election officials made very little fanfare about unveiling or dropping the new voting option, and one county election official told The New Jersey Globe that was by design.
"This was all very hush-hush," one county clerk told the Globe. "They didn't want this heavily publicized. They were just testing it and didn't want people to know about it in case something went wrong."
In Delaware, it was unclear at first who could participate in the electronic ballot return option. In West Virginia's primary this month, for instance, the option only was available to voters with disabilities that would otherwise not allow them to cast a secret ballot.
Overseas and military voters also were eligible; a total of 180 people in West Virginia used it, according to a spokesperson for Secretary of State Mac Warner.
In Delaware, state officials decided to allow anyone who applies for an absentee ballot using the excuse that they are "sick or physically disabled" the option to return the ballot electronically. But that essentially could cover every registered Democratic and Republican voter in the state after a rule change made in light of the coronavirus pandemic qualified anyone practicing social distancing.
Still, fewer than 3,000 people used the system to return their ballots.
Vendor defends online system
In an email to NPR, Democracy Live CEO Bryan Finney defended the system, but also said that considering how many questions the state received regarding the pilot, it made sense that officials there decided to discontinue it, even without having any noticeable technical issues.
"Those voters [that voted that way] may have likely been disenfranchised from voting if not for the OmniBallot system," Finney said. "The state has a tough enough job conducting elections, without fielding numerous calls on a pilot that made up less than .05% of the ballots."
But it's also possible the system wasn't used more widely because of how little information about it was announced by the state.
And skeptics worry that online voting advocates will attempt to build a case for broader online voting in the future by using examples like this — a state that had no publicized issues, but also did not widely announce the scope of the program or allow a third party to publicly test the system's security.
"Internet voting vendors and proponents have been pushing online voting with the false assertion that the number of ballots cast online is minimal and, therefore, not a security risk — but this just isn't true," said Susan Greenhalgh, the senior election security advisor for the advocacy group Free Speech For People. "Delaware is a clear example that offering online voting to a subset of voters is the camel's nose under the tent."
Voters in limbo
Greenhalgh noted that while the Democracy Live online ballot return option is fairly new, internet voting really isn't.
For the past decade, election officials nationwide have offered an array of fairly insecure internet workarounds, aimed at helping voters who may have trouble using a vote-by-mail system, including voters with disabilities and military voters serving overseas.
The country's quick ramp-up towards more mail voting in response to the pandemic means there could potentially be more of these voters left in limbo.
In 2018, more than 100,000 voters, mostly military and overseas voters, cast ballots online, and that number is likely to double in November, said Greenhalgh.
Most of those 2018 votes were submitted via email, which the federal government also deemed insecure in its recent communication with the states. Delaware is still allowing absentee voters who use the "sick or physically disabled" excuse to return their ballots via email.
Many cybersecurity experts however, say the best middle ground between accessibility and security at this point are systems that allow voters to receive and mark their ballots electronically — then use the mail to get the ballot from the voter to an election official.
Democracy Live offers this service as well, and Finney said the vast majority of his customer jurisdictions use it and do not offer an electronic ballot return.
There is wide consensus within the cybersecurity and election community that internet voting options aren't ready for wide use in 2020. But still, Halderman worries that a potential second wave of coronavirus infections this autumn could motivate more states to look past that and give online voting a shot.
"That's where the risk really grows astronomically," Halderman said. "Because as soon as there are enough votes to shift a major election result being cast through an online voting system, it becomes an extremely attractive target for sophisticated attackers, including foreign nations."
Copyright 2021 NPR. To see more, visit https://www.npr.org.
