Feeds

US election: New Jersey email voting plan 'best of bad bunch'

Better to give a man two votes than none

Combat fraud and increase customer satisfaction

Security watchers have given a lukewarm backing to plans by New Jersey authorities to allow email voting for residents of the state left displaced by Superstorm Sandy.

New Jersey Lieutenant Governor Kim Guadagno issued a directive on Saturday permitting voters to download absentee ballots before returning them by either email or fax in order to cast their vote, as previously reported.

"I'm not filled with confidence, but this seems like the best of a bunch of bad alternatives," commented security guy Bruce Schneier, in a brief blog post.

Robert David Graham of Errata Security is even more negative: "Is anybody taking bets on how much the vote-by-email will exceed the population in New Jersey?"

There are some safeguards in place to prevent this scenario, as Ed Felten of Princeton's Center for Information Technology Policy explains:

"Although the order does allow a ballot to be submitted by email or fax, this is subject to the submission of a signed hardcopy ballot, and the law directs election officials to compare the electronic ballot with the eventually received hardcopy," he writes on the Freedom to Tinker blog.

Unless it's encrypted, email isn't secure. By default email can be easily spoofed or intercepted and read. That's why sending password reminders by email is a no-no. The medium is a total non-starter for anything more sensitive.

Computer scientist Matt Blaze argues the use of email for voting is undesirable but justifiable in the midst of the aftermath to a national disaster.

"The security implications of voting by email are, under normal conditions, more than sufficient to make any computer security specialist recoil in horror," Blaze, a computer scientist at the University of Pennsylvania, explains. "Email, of course, is not at all authenticated, reliable, or confidential, and that by itself opens the door to new forms of election mischief that would be far more difficult in a traditional in-person polling station or with paper absentee ballots.

"If we worry that touchscreen 'DRE' electronic voting machines might be problematic, email voting seems downright insane by comparison. But a knee-jerk reaction to the worst case scenario is probably not helpful right now. Clearly, email voting is risky. The question is whether these risks outweigh the benefits, and whether the technical and procedural safeguards that are in place are adequate to mitigate them under these rather unique circumstances."

Even supporters of internet voting more generally are skeptical that the effort will go smoothly without running into problems, such as individuals attempting to vote multiple times or potential denial-of-service attacks from spammers1, Politico reports.

Changes in voting laws have facilitated email and fax voting for overseas voters and military personnel since 2010. However only 3,500 ballots were cast this way in the mid-term elections to Senate and Congress and there is some concern that the approach is not ready for prime time.

The scheme could potentially service hundreds of thousands of votes, Charles Stewart, co-director of the Cal Tech-MIT Voting Technology Project, told Politico. It would be better to allow displaced New Jersey residents to cast their vote in Tuesday's presidential and Senate races using provisional ballots at any polling station close to where they have been relocated, Stewart argued.

Separate directives issued over the weekend enable displaced voters and emergency relief workers to vote by provisional ballot at a polling place in a county other than the voter’s county of registration.

New Jersey hasn't voted Republican in presidential elections since 1988, when the state went for George Bush (senior). It's a safe bet that Obama will claim New Jersey when the results are tallied in the early hours of Wednesday, however people are allowed to vote. ®

Bootnote

1New Jersey features in seven citations on Spamhaus's ROKSO database of spam operations. New York, by comparison, gets 73 and California, 72. Nonetheless there's a suspicion that more than a few spammers live in New Jersey, making the spam DDoS a slightly more plausible threat than might otherwise be the case.

Update

Matt Blaze has been in touch to say:

I argued no such thing, and indeed have never argued any such thing. I simply said that the question is whether the risks are outweighed by the benefits. And then I went on to list many ways in which they would not.

You are characterizing me as having a position that is opposite of what I believe, and I would appreciate a correction.

SANS - Survey on application security programs

More from The Register

next story
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.