Flaws in D.C.'s online voting system should serve as a warning to all states

Tuesday, October 19, 2010

THE DISTRICT'S experiment with online voting got national headlines when a team of computer scientists infiltrated the system. Votes cast for registered candidates were switched to votes for evil science-fiction robots; the hackers left, as their calling card, the University of Michigan fight song. D.C. officials shouldn't be embarrassed, because their willingness to have a public test is an important wake-up call about the potential dangers of Internet voting. States rushing to implement online voting should pause, lest they put the nation's elections at risk.

To make it easier for some 950 overseas and military voters to cast absentee ballots, D.C. election officials developed digital vote by mail and set up an unusual public testing period. With little notice, it took University of Michigan professor J. Alex Halderman and his graduate students just 36 hours to hack and obtain almost total control of the system. They were able to change all the votes that had been cast, and they obtained the names and passwords of voters eligible to use the online system. Most chilling, as Mr. Halderman told a D.C. Council committee, was the discovery that computer users in Iran and China were also trying to infiltrate the system. Needless to say, election officials canceled the rollout of the pilot, planned for the Nov. 2 election, although overseas voters will be able to print ballots and mail them in.

The motivation for online voting is laudable. Too many overseas voters, including men and women serving in the military, have been disenfranchised because of distance and spotty mail service. In recent elections, a third of military votes went uncounted because they arrived late. Congress was right to pass legislation requiring states in most cases to send ballots to military and overseas voters 45 days prior to federal elections. But the impetus to remove voting roadblocks is, we fear, causing some states to rush recklessly toward Internet voting despite the limits of today's security technology. Mr. Halderman made clear in his testimony that even if specific weaknesses he exploited were addressed, other vulnerabilities would surely emerge. Voting, with its need for anonymity and secrecy, presents security challenges not present in such Internet enterprises as online banking.

Verified Voting, a nonprofit that works to ensure reliable elections, called the District's experiment "a visceral demonstration of just how serious the threats really are." Overseas Vote Foundation, a group that has worked tirelessly to enhance the enfranchisement of overseas voters, won't endorse Internet voting because of the risks. States that think otherwise should, at the very least, follow the District's example and put their systems to a public test.

© 2010 The Washington Post Company