July 9, 2020


Connecting People

MIT researchers say mobile voting app piloted in U.S. is rife with vulnerabilities

Elections officials in a lot of states have piloted many cellular voting programs as a system of increasing entry to the polls, but MIT scientists say just one of the much more well known applications has safety vulnerabilities that could open up it up to tampering by terrible actors.

The MIT evaluation of the application, known as Voatz, highlighted a quantity of weaknesses that could make it possible for hackers to “alter, halt, or expose how an person consumer has voted.”

Moreover, the scientists identified that Voatz’s use of Palo Alto-based mostly vendor Jumio for voter identification and verification poses potential privacy troubles for buyers.

The review arrives on the heels this month’s problems-plagued Iowa Democratic Presidential Caucus, which utilised an on-line application to retail store votes but unsuccessful to do so correctly for the reason that of a coding flaw and insufficient screening.

Some safety gurus have long argued that the only secure variety of voting is paper ballots.

iPhone iOS voatz blockchain voting Voatz

Voatz Iphone cellular voting application.

The Voatz cellular voting application has been utilised in modest pilots involving  only about 600 voters overall in Denver, West Virginia, five counties in Oregon, Utah and Washington State, where by the principal focus was on inclusivity for absentee voters living overseas.

In reaction, Voatz called the MIT report “flawed” for the reason that it based mostly its evaluation on a long-outdated Android edition of the application.

“Had the scientists taken the time, like nearly a hundred other scientists, to exam and verify their promises applying the most up-to-date edition of our system by way of our community bug bounty method on HackerOne, they would not have ended up creating a report that asserts promises on the basis of an faulty system,” Voatz said in a blog post today.

“We want to be crystal clear that all nine of our governmental pilot elections done to date, involving less than 600 voters, have been done securely and securely with no documented troubles,” Voatz said.

In 2018, West Virginia piloted Voatz’s cellular voting application for resident services customers and spouse and children living overseas who needed to vote in the midterm typical election. 

West Virginia Secretary of State’s workplace pointed to a Section of Homeland Stability safety assessment of the 2018 Voatz pilots indicating there was “no risk actor behaviors or artifacts of previous nefarious pursuits had been detected in the vendor’s networks.”

Audits of paper ballots created by the Voatz plaform on election day also verified the results had been exact, according to the Secretary of State’s workplace.

“We want to get the word out to media outlets like Computerworld to guarantee WV voters that we are getting every single feasible precaution to harmony election safety and integrity with WV prerequisite to present absentee ballots electronically to overseas, armed service and absentee voters living with actual physical disabilities,” Mike Queen, deputy main of personnel for West Virginia Secretary of State Mac Warner, said by way of e mail.

The MIT review, however, underscored the want for Voatz’s cellular application style to be much more transparent for the reason that community facts about the know-how is “vague” at finest.

Voatz’s system works by using a blend of biometrics, this kind of as cellular-mobile phone based mostly facial recognition, and components-backed keystores to present end-to-end encrypted and voter-verifiable ballots. It also works by using blockchain as an immutable electronic ledger to retail store voting results.

Voatz has declined to present formal aspects about its system, citing the want to secure intellectual house, the scientists said in their paper.

In a blog submit these days, Voatz known as the researchers’ strategy “flawed,” which “invalidates any promises about their capability to compromise the overall technique.

“In small, to make promises about a backend server with no any proof or relationship to the server negates any degree of credibility on behalf of the scientists,” Voatz said.

The scientists also known as Voatz out for reporting a College of Michigan researcher who in 2018 done an evaluation of the Voatz application. “This resulted in the FBI conducting an investigation versus the researcher,” the MIT scientists said.

It’s not the initially time Voatz has been criticized for not getting much more open up about its know-how. Last May perhaps, computer experts from Lawrence Livermore National Laboratory and the College of South Carolina, together with election oversight groups, printed a paper that criticized Voatz for not releasing any “in-depth complex description” of its know-how.

“There are at least 4 organizations attempting to give web or cellular voting remedies for superior-stakes elections, and just one 2020 Democratic presidential applicant has incorporated voting from a cellular unit by way of the blockchain in his policy plank,” the MIT scientists said in their paper. “To our know-how, only Voatz has successfully fielded this kind of a technique.”

Alongside with Voatz, Democracy Live, Votem, SecureVote and Scytl have all piloted cellular or on-line voting know-how in many community or non-public balloting that incorporated company stockholder and college or university board elections. Most recently, a Seattle district piloted the Democracy Live technology in a board of supervisors election that was open up to 1.two million registered voters.

Tusk Philanthropies, a nonprofit targeted on marketing cellular voting as a way to raise voter turnout, has delivered economical assist to assistance governments apply cellular voting pilots, permitting the agencies to pick out the vendor service provider.

In a assertion to Computerworld, Tusk said it feels confident in the results of all the pilot elections for the reason that it done impartial, 3rd-social gathering audits “which confirmed that votes solid around the blockchain had been recorded and tabulated correctly.”

“With that getting said, we constantly welcome new safety facts and will do the job with safety gurus to evaluate this paper,” Tusk said. “Security is an iterative system that can only get better around time. There is no home for mistake in our elections, specially when it arrives to facts leakage, compromised encryption, broken authentication, or denial-of-services assaults.”

Medici Ventures, the wholly-owned financial commitment subsidiary of Overstock.com, has also backed Voatz, whose application has mostly been utilised to make it possible for absentee voter services customers and their family members to solid their ballots by way of their smartphones from anyplace in the earth.

Jonathan Johnson, CEO of Overstock and president of Medici Ventures, responded in a assertion to a New York Periods article about the MIT review, stating he thinks the Voatz know-how is dependable and risk-free.

“It not only stops voting fraud, but it also protects the privacy of each individual voter. The Voatz application even generates a paper ballot that can be audited to guarantee the fidelity of the vote,” Johnson said. “This is, we think, the ideal path forward to risk-free innovation in election know-how. We ought to not permit ourselves derail the upcoming of voting.”

Critics of cellular or on-line voting, including safety gurus, think it opens up the prospect of server penetration assaults, client-unit malware, denial-of-services assaults and other disruptions — all involved with infecting voters’ computers with malware or infecting the computers in the elections workplace that cope with and depend ballots.

Jeremy Epstein, vice chair of the Affiliation for Computing Machinery’s US Technological innovation Coverage Committee (USTPC), has been a vocal critic of cellular voting platforms, such as Voatz. He said the MIT review was “very thorough” and demonstrates specifically what gurus have been stating for several years.

“Internet voting is risky. It can be no surprise that the Voatz technique is vulnerable to lots of forms of assaults, even to an attacker with no entry to supply code or other inside facts,” Epstein said by way of e mail. “The assaults shown by MIT are nicely inside of the abilities of nation-condition adversaries who are interested in manipulating US elections, and this kind of an adversary will not publish their results as the MIT staff has finished, leaving us with an election that may possibly be undetectably manipulated.”

The five-yr-previous Voatz slammed the MIT scientists for never connecting even the outdated application they utilised to the company’s servers, which are hosted by Amazon AWS and Microsoft Azure.

In the absence of connecting to the actual servers recording community votes, “the scientists fabricated an imagined edition of the Voatz servers, hypothesized how they labored, and then manufactured assumptions about the interactions amongst the technique elements that are simply just false,” Voatz said.

Epstein retorted that Voatz’s remarks “demonstrate that they you should not fully grasp either the severity of the assaults or the way safety is effective in typical.

“Any election formal applying Voatz products and solutions would be nicely encouraged to terminate their strategies, just before a stealthy assault in a authentic election compromises democracy,” Epstein said.

Copyright © 2020 IDG Communications, Inc.