For decades, the cybersecurity community has had a consistent message: Mixing the Internet and voting is a horrendous idea.
"I believe that's about the worst thing you can do in terms of election security in America, short of putting American ballot boxes on a Moscow street," howled Sen. Ron Wyden, D-Ore., on the Senate floor this year.
And yet, just a few years removed from Russia's attack on democracy in the 2016 presidential election, and at a time of increased fear about election security, pockets of the U.S. are doing just that: experimenting with Internet voting as a means to increase turnout.
Some experts are terrified. Others see the projects as necessary growth in an American voting system they call woefully stuck in a previous century.
The number of people expected to vote this way in 2020 is still minuscule. But the company administering the system and advocates pushing for its use are open about wanting to fundamentally change the way Americans cast their ballots over the coming decade.
Two directions at once
The U.S. does not have a federalized election infrastructure. That means states and localities have the freedom to oversee voting how they see fit, with little oversight from the federal government.
In some cases, that can lead to contradictory trends: At the same time some states implement same-day voter registration, others add more burdensome photo ID requirements.
Voting technology is no different.
Just last year, Alaska shut down a Web portal it had been using to accept absentee ballots from overseas voters.
"There was concern in regards to security of the system," says Carol Thompson, an elections official with the Alaska Division of Elections. "People getting in there or hacking the system."
She said there was no indication that anyone had succeeded in breaching the portal, but overall, election officials like Thompson are warier of computers than ever before. It just seemed like a safer alternative to avoid them.
The Democratic National Committee made a similar judgment call this year in nixing a proposal for remote caucusing in Iowa and Nevada.
At the same time, however, West Virginia and counties in Utah, Oregon and Colorado are at different stages in implementing a new Internet voting app to allow overseas and military voters to cast votes on their phones.
The goal is to make things easier for some of the voters who are farthest away.
"These are the people who are putting their lives on the line on a daily basis, and yet their votes haven't been counted up to this point," said Mac Warner, West Virginia's secretary of state, in pointing to a study that showed a dismal rate of accepted ballots among active-duty military voters in 2016.
Looming security questions
Exactly 144 overseas voters used the mobile app to vote in West Virginia in 2018, even though most experts who focus on cybersecurity and voting say the Internet isn't yet secure enough to mix with elections.
The broad push recently has been back to paper ballots and machines that produce a voter-verified paper trail, because they allow for election results to be double-checked in a way that can guarantee an election's accuracy.
Many experts argue that no computer can be completely unhackable, so to get the public to have full faith in its elections, the voting has to be done on paper.
"I come down with getting as many computers out of the process as you can," said Rich DeMillo, the former chief technology officer for Hewlett-Packard and now a cybersecurity expert at the Georgia Institute of Technology. "Every time you introduce a technology layer, you have these cascades of unintended consequences."
Another problem is transparency.
The Boston-based company that administers the app used in West Virginia, Voatz, insists that its product is safe from the sort of cyber-intrusions that multiple states endured leading up to the 2016 election.
Nimit Sawhney, the company's co-founder and CEO, says that part of the problem with the conversation around Internet voting is that it glosses over the "advertised and unadvertised" issues with the current system, including that it allows for more human error.
A number of states, for instance, also already allow overseas voters to return ballots via email or fax, which are both considered incredibly insecure. So the app could be an improvement even if broadening its use could present problems.
Sawhney said there are two mindsets when it comes to thinking about how to improve voting.
"The threats are not going away. You can hide from them and say we will go back to the Dark Ages. That's a very negative outlook," Sawhney said in an interview with NPR.
"We are on the other side of the security community, where we believe that just because the Internet is never going to be 100% safe doesn't mean you can't use modern technologies to make it safe enough."
But the technology, which uses the security features of smartphones such as biometrics along with blockchain technology, has not gone through any sort of federal certification program. Many of the under-the-hood security details remain private because the company says they're proprietary.
A group of cybersecurity experts wrote an open letter earlier this year listing questions they still had about the app. It is 10 pages long.
"While much of this secrecy might be understandable for an ordinary business product and service, it should not be acceptable in a public voting system whose details should be transparent to voters, candidates, and the public at large," the cybersecurity authors wrote.
DeMillo, from Georgia Tech, agreed.
"There has to be transparency in the voting process, or the people that lose the election aren't going to believe the election result," DeMillo said. "And that [transparency] simply doesn't exist in the Internet. The whole idea of the Internet is to hide what's going on under the covers."
A plan to improve democracy
The U.S. trails most developed countries in terms of voter turnout, and many critics blame the current voting system for being too burdensome.
Online-voting advocates say that this difficulty, which discourages huge swaths of Americans every election, is a bigger problem for the nation than the risk of a hypothetical hack.
"If you look at the congressional primaries, the voter turnout rate can be as low as 11%. And then with the gerrymandering, it means a very few people are electing members of Congress," said Sheila Nix, the president of Tusk Philanthropies, an organization aimed at expanding mobile voting.
Don't see the graphic above? Click here.
Nix says she hopes more jurisdictions nationally begin offering a mobile app voting option for military and overseas voters. After that, Nix and Sawhney both say, the plan is to expand to other populations that have difficulty with traditional voting options, including disabled voters and people in remote parts of the country.
Within a decade, Nix says, she hopes a mobile phone-based option is widely available, because she feels like younger voters won't vote without one.
"It just seems hard to believe that they're going to go into a system where they're going to go into a polling place or the vote-by-mail system, when they don't have a good understanding of stamps," Nix said.
"Our theory is, let's get it started ... so that in four or eight years from now, when we get an influx of young voters, we have something to offer them and we don't make our turnout problem worse."
The costs of convenience
A common refrain among online-voting advocates is that people bank and shop online, so they should be able to vote online too.
But breaches and fraud happen online every day, DeMillo observes, and companies accept the millions in dollars in losses as the cost of doing business. Fraud is such a part of the world of finance that the American Bankers Association issues regular reports about it.
Election officials can't accept that a certain percentage of votes cast might not be legitimate, because, among other reasons, so many races in the U.S. are decided by thin margins.
When asked how voting compares with the other cybersecurity problems he's encountered throughout his career, DeMillo doesn't hesitate.
"It's the most complex," he says. "And it's not the most complex for technical reasons. It's the most complex because it's at this wicked intersection of technology, politics, sociology and psychology."
Copyright 2019 NPR. To see more, visit https://www.npr.org.
