New Jersey's Email Vote May Be Recipe for Disaster

/ Source: TechNewsDaily

As a result of Hurricane Sandy, New Jersey has granted residents displaced from their homes the ability to vote by email in tomorrow's national elections.

As we pointed out last week, email voting sounds great as a concept, but it has computer security experts worried.

"How will the emailed ballots be secured against tampering or loss?" University of Pennsylvania computer-science professor Matt Blaze wrote on his personal blog yesterday (Nov. 4). "Email messages themselves have no intrinsic protection against modification, forgery, copying or deletion when in transit."

This past weekend, New Jersey enabled email voting for displaced residents by re-designating such persons as "overseas voters."

Displaced New Jersey residents must first request a mail-in ballot via email or fax by 5 p.m. tomorrow (Nov. 6).

If they qualify, they will be sent a ballot, along with a "waiver of secrecy" form, via the same method they requested it. They then have until 8 p.m. tomorrow to submit the completed ballot and waiver of secrecy.

[ How Hackers Could Steal the Next Election ]

Most states let residents who live outside the United States vote by mailed-in ballot, and some states permit emailed votes on Election Day as long as a mailed-in paper ballot arrives at a county polling office soon afterward.

But New Jersey Lieutenant Governor and Secretary of State Kim Guadagno's order granting "overseas" status to displaced residents doesn't mention anything about a paper ballot. And the county clerk of Essex County, near New York City, told WNBC-TV that the entire program is being run on the honor system.

To Blaze, that doesn't sound like any way to run an election.

"Someone is going to lose each contested race on the ballot," he wrote. "The email voting system must be sufficiently secure to withstand any challenge to the result they might mount."

Andrew Appel, a professor of computer science at Princeton, noted that votes submitted by email alone could be tossed out immediately.

"If voters and county clerks follow [Guadagno's] instructions, their votes will be invalid," Appel wrote on Princeton's Freedom to Tinker blog yesterday.

"New Jersey Statute ... requires an additional step that Lt. Gov. Guadagno omitted from her directive: ... 'Immediately after a copy of the voted overseas ballot or federal write-in absentee ballot has been transmitted by electronic means to the appropriate county board of elections ... the overseas voter shall place the original voted ballot in a secure envelope, together with a certificate ... and send the documents by air mail to the appropriate county board of elections.'"

Fortunately, New Jersey authorities may be seeing the light. Both Blaze and Appel updated their blog postings later yesterday to reflect news, not confirmed, that state officials would in fact require that each emailed vote be followed up with a mailed-in completed paper ballot.

As of midday today (Nov. 5), no official directive regarding that paper-ballot requirement had been issued. The deadline for paper ballots would have to be different from that for normal "overseas voters," who must mail them by the end of the day today, not tomorrow.

However, as Blaze pointed out, there's a simpler, more secure way for displaced New Jersey residents to vote. Per another directive from Guadagno, "a displaced voter may vote by provisional ballot at any polling place in the State." (Later today, New York Gov. Andrew Cuomo announced that residents of his state could do the same.)