By Angelo Lynn
Editor’s note: Angelo Lynn is the editor and publisher of the Addison County Independent, a sister publication of the Mountain Times.
As a Vermont state legislator, one of the most satisfying parts of the job is to craft legislation that solves a problem for a particular group of constituents.
In H.429, legislators crafted a bill that attempts to improve several aspects of the state’s election laws, including what was called a “sore loser law” in which the bill limits the ability of a candidate who loses in a primary battle to re-enter the general election as an independent candidate for the same office. But a clause in the bill also makes changes to expand online voting.
This brief aspect of the bill was drafted and passed with bipartisan support and not much controversy for what are good reasons: it sought to make voting easier for a select group of citizens, it was expanded from an existing system, and adequate effort was made to ensure the voting process was secure. And it sought to accomplish what everyone saw as a public good: larger voter turnout via a more convenient process.
But what seems secure isn’t always so.
Currently, Vermont towns can send blank ballots to a few select voters — basically military, overseas military and citizens with disabilities who request absentee ballots. All ballots are filled out and mailed back via U.S. postage, with military personnel having a special premium paid service that expresses it back to the states. The new law would allow for military, those with disabilities and voters who request an absentee ballot emailed to them, with also the ability for that ballot to be returned electronically.
Two problems jump to the fore: 1) while the bill suggests a limit to those who can receive an electronic absentee ballot, the language (even though it is restricted under sub-section 2539) is relatively open-ended, meaning a voter who asked for an absentee ballot, declaring they were ill or injured, would likely get one; 2) more importantly, by allowing voters to return their complete ballots online they risk exposing the election to fraudulent votes.
As to the first point, here’s the pertinent language of § 2539: “(b) … In the case of persons who are early or absentee voters due to illness, injury, or disability, if the voter or authorized person requests in his or her application or otherwise that early voter absentee ballots be mailed or electronically delivered, the town clerk shall mail or electronically deliver the ballots; otherwise the ballots shall be delivered to the voter by justices of the peace as set forth in section 2538 of this subchapter.” Read it as you will, but the potential is there for a substantial uptick in online absentee voting.
As to the second point, it turns out that hackers are a lot smarter than we think they are, and the potential is there to create a lot of harm.
That finding comes from Susan Greenhalgh, Senior Advisor on Election Security for Free Speech For People, a nonprofit dedicated to preventing election fraud. After years of following online voting, appearing in front of state legislators across the country, writing numerous studies on the issue, and testifying before Congress, Greenhalgh reports that online voting systems “are, quite simply, not secure,” nor are the processes that say they aren’t ‘online voting’ but still rely on the digital processing of ballots, such as Vermont’s system would under this bill.
But don’t take Greenhalgh’s word for it. She relies on assessments from federal security agents in four departments: the Federal Bureau of Investigation (FBI), the Department of Homeland Security’s Cybersecurity Infrastructure Security Agency (CISA), the U.S. Elections Assistance
Commission (EAC) and the National Institute for Standards and Technology (NIST).
Greenhalgh notes these four agencies concluded in a recent risk assessment that “electronic ballot return” is “High” risk, even with security safeguards and cyber precautions in place. The agencies further warn that electronic ballot return “faces significant security risks to the confidentiality, integrity, and availability of voted ballots,” and that these risks can “ultimately affect the tabulation and results and can occur at scale,” she notes, adding that the four agencies “explicitly recommend voting by paper ballots.”
In recent interviews with Greenhalgh this past week, she also reports that vendors selling these online voting systems, including Democracy Live which is the vendor Vermont is working with, too often over-sell the security of their product.
Greenhalgh writes in one extensive report: “From public statements, news reports, press releases and marketing materials it becomes evident that the vendors of these online voting systems have been pitching their systems to state and local officials with potentially false, misleading and/or deceptive marketing claims. These spurious claims have served to counter the scientific conclusion that online voting is dangerously insecure and unsuitable for public elections… There is zero regulation or oversight of the online voting system vendors, and they have exploited this fact to push their products with false and specious claims,” she continues. “Even worse, with no check on these vendors and their deceptive marketing, state officials are misled to believe online voting can be done safely and reliably, promoting laws to allow this insecure practice.”
Greenhalgh reports that legislators are also led to believe that because “the tabulation process is not online, the system is secure… (but that) misses the point that the voted ballots, which contain the vote data and original record of voter intent, are sent over the internet and are vulnerable to cyber manipulation. Once that data is tampered with, it doesn’t matter how secure your tabulation might be.”
Nor is the fact that the return ballots are first made into a pdf, which legislators are led to believe can’t be tampered with. Wrong again. Hackers can retrieve and manipulate a pdf ballot with ease, Greenhalgh reports, citing several tests done by universities like MIT.
Greenhalgh provides numerous studies and reports to substantiate her position, some of which were noted in a letter sent late last week to Vermont state senators. In that letter, the organizations Common Cause, Verified Voting, Brennan Center for Justice, Public Citizen, and FreeSpeechforPeople.org all urged Vermont legislators to remove the electronic ballot return provisions from the bill.
We strongly agree. Voting online is a great idea, but it’s clear that its security is not yet adequate. We encourage the Senate to thoroughly research this aspect of the bill, understand the assurances from vendors are suspect (follow the money), and rely on federal intelligence agencies to provide scientific assessments of the risks involved.
The Vermont Senate Government Operations Committee, chaired by Sen. Ruth Hardy, D-Addison County, will hear testimony regarding online voting Wednesday, March 29. Hardy has confirmed her committee to review the security of these provisions in the bill thoroughly.
For those looking for more information on the security of internet voting, here are two reports: tinyurl.com/3cktprv2 and tinyurl.com/5n6h379e.
