This startup wants to secure absentee voting with a blockchain
A Boston startup called Voatz wants to put blockchain technology to work on something more civic-minded than recording cryptocurrency transactions: voting.
The idea of using distributed-ledger systems to count ballots may seem goofy if not “abysmally stupid,” as Center for Democracy & Technology chief technologist Joseph Lorenzo Hall said in an e-mail.
But in the specific use case Voatz will test this Election Day in West Virginia—absentee voting by military personnel deployed overseas, who may not be able to count on timely mail delivery of absentee ballots—it might not be insane.
How it will work
Traditionally, voting absentee while deployed overseas has required mailing in a ballot. In this pilot, announced Sept. 20 by West Virginia Secretary of State Andrew “Mac” Warner, military absentee voters from 24 counties will be able to use Voatz’s iPhone and Android apps instead of paper mail or the more recent option of voting by fax (no, really).
As a YouTube clip explains, after registering to use this, they’ll install the app and then confirm their identity by taking a photo of their driver’s license or passport as well as a video selfie, all verified by humans.
They’ll record their ballot choices in the app, authenticate it with their fingerprint or with another selfie and then submit the vote. Voatz will record that ballot, stripped of details identifying the voter, across eight nodes running the HyperLedger blockchain framework.
Voters will get a copy of their ballot e-mailed back, while Voatz will record the vote on paper and deliver that to state officials for their count, CEO Nimit Sawhney said.
“This is a work in progress,” said Mike Queen, Warner’s deputy chief of staff, in an interview. “It’s a risk-versus-reward opportunity for a small segment of voters that right now are disenfranchised.”
He said the state expects to receive “a couple of hundred” ballots this way. “Secretary Warner is not advocating it as a mainstream way to vote,” Queen emphasized.
In an earlier test with deployed service members during May’s primary election, 13 cast Voatz ballots out of 15 who installed the app.
Taxpayer dollars aren’t paying for West Virginia’s test; instead, investor and political strategist Bradley Tusk’s foundation is underwriting it. In an e-mail, Tusk said the general-election costs should total about $150,000.
Security questions
What has techies like CDT’s Hall so irate about what he called “a distraction from real work we need to do”? It’s not just a matter of blowback to blockchain hype that grew tiresome two years ago. Critics also point to security concerns specific to voting, where there’s no “undo” button once a ballot has been cast.
“The whole thing assumes that there’s no malware on the voter’s phone, there’s no software recording what the voter is doing,” said Jeremy Epstein, a computer-security expert who spent years warning of grotesque security flaws in the Winvote voting machines that Virginia finally decertified in 2015.
Sawhney said Voatz only supports smartphone models it rates as secure, at the cost of excluding “roughly half of the Android market,” and has undergone multiple security audits.
“As part of the audit, every line of source code was audited,” Sawhney said. He did not identify the firm.
In September, Voatz’s site named one security-audit firm, Wilmington, Mass.-based Security Innovation, but that line is now blank. A publicist for Security Innovation said a non-disclosure agreement barred the company from commenting.
Queen said West Virginia did not look at Voatz’s code but inspected its offices and found no issues requiring his office’s attention.
“We have been able to do 33 elections without any problems,” Sawhney said. One of its most recent elections was the convention of the Massachusetts Democratic Party, which the party’s executive director pronounced a success.
“We used Voatz at our convention alongside a paper ballot and results were fast, secure and accurate,” e-mailed Veronica Martinez. She said the party plans to continue employing Voatz.
Blockchain banter
Recording votes in a blockchain—by definition, an immutable and decentralized digital ledger—also raises long-term risks.
“With a blockchain, nobody can ever change anything,” Epstein said. “So unless you destroy the blockchain, you’ve got all those votes forever.” That leaves them subject to future de-anonymization, while federal voting guidelines allow the destruction of ballots after 22 months.
Voatz’s setup is and is not like a standard-issue blockchain. It’s not public or decentralized, as the company controls all the nodes in what it calls a “permissioned” system. But it does let clients decide how long to keep the ledger set up for each election instead of preserving every one in perpetuity.
Voatz spokesperson Rachel Dabb said that in West Virgina’s case, the company plans to wipe that ledger sometime this winter, after a post-election audit.
David Gerard, author of the book “Attack of the 50 Foot Blockchain,” questioned why Voatz needs a blockchain at all, considering that we already know how to encrypt data transmissions and verify and log writes to a database.
“Fundamentally, we have that sort of ledger already,” he said. “The blockchainy stuff is clearly decorative.”
The alternatives may be worse
It’s important to consider the context of West Virginia’s experiment—as Queen noted, soldiers in tents in Afghanistan can’t count on the older options of mail or fax.
A full 20 states and the District of Columbia allow at least some classes of voters to return ballots via the much-harder-to-secure medium of email, according to a tally by the National Conference of State Legislatures.
Epstein suggested that instead, states allow voting by proxy or via a two-step video link, in which one observer would verify a voter’s credentials and another would record the votes as marked on a ballot held up to the camera.
We should consider something better than the current alternatives for remote voting, because participation by Americans outside the U.S. is terrible overall. The Federal Voting Assistance Program released a survey in-mid September finding that in 2016, only 7% of eligible voters overseas cast ballots.
It’s hard to fault a state for wanting to do better for its citizens who can only vote far from home. But you should object to any state trying to put this concept into wider use until all the returns come in on early experiments like West Virginia’s.
Email Rob at rob@robpegoraro.com; follow him on Twitter at @robpegoraro.
More from Rob:
Your wireless carrier may stop you from dumping cable TV
