Feeds

US election: New Jersey email voting plan 'best of bad bunch'

Better to give a man two votes than none

Secure remote control for conventional and virtual desktops

Security watchers have given a lukewarm backing to plans by New Jersey authorities to allow email voting for residents of the state left displaced by Superstorm Sandy.

New Jersey Lieutenant Governor Kim Guadagno issued a directive on Saturday permitting voters to download absentee ballots before returning them by either email or fax in order to cast their vote, as previously reported.

"I'm not filled with confidence, but this seems like the best of a bunch of bad alternatives," commented security guy Bruce Schneier, in a brief blog post.

Robert David Graham of Errata Security is even more negative: "Is anybody taking bets on how much the vote-by-email will exceed the population in New Jersey?"

There are some safeguards in place to prevent this scenario, as Ed Felten of Princeton's Center for Information Technology Policy explains:

"Although the order does allow a ballot to be submitted by email or fax, this is subject to the submission of a signed hardcopy ballot, and the law directs election officials to compare the electronic ballot with the eventually received hardcopy," he writes on the Freedom to Tinker blog.

Unless it's encrypted, email isn't secure. By default email can be easily spoofed or intercepted and read. That's why sending password reminders by email is a no-no. The medium is a total non-starter for anything more sensitive.

Computer scientist Matt Blaze argues the use of email for voting is undesirable but justifiable in the midst of the aftermath to a national disaster.

"The security implications of voting by email are, under normal conditions, more than sufficient to make any computer security specialist recoil in horror," Blaze, a computer scientist at the University of Pennsylvania, explains. "Email, of course, is not at all authenticated, reliable, or confidential, and that by itself opens the door to new forms of election mischief that would be far more difficult in a traditional in-person polling station or with paper absentee ballots.

"If we worry that touchscreen 'DRE' electronic voting machines might be problematic, email voting seems downright insane by comparison. But a knee-jerk reaction to the worst case scenario is probably not helpful right now. Clearly, email voting is risky. The question is whether these risks outweigh the benefits, and whether the technical and procedural safeguards that are in place are adequate to mitigate them under these rather unique circumstances."

Even supporters of internet voting more generally are skeptical that the effort will go smoothly without running into problems, such as individuals attempting to vote multiple times or potential denial-of-service attacks from spammers1, Politico reports.

Changes in voting laws have facilitated email and fax voting for overseas voters and military personnel since 2010. However only 3,500 ballots were cast this way in the mid-term elections to Senate and Congress and there is some concern that the approach is not ready for prime time.

The scheme could potentially service hundreds of thousands of votes, Charles Stewart, co-director of the Cal Tech-MIT Voting Technology Project, told Politico. It would be better to allow displaced New Jersey residents to cast their vote in Tuesday's presidential and Senate races using provisional ballots at any polling station close to where they have been relocated, Stewart argued.

Separate directives issued over the weekend enable displaced voters and emergency relief workers to vote by provisional ballot at a polling place in a county other than the voter’s county of registration.

New Jersey hasn't voted Republican in presidential elections since 1988, when the state went for George Bush (senior). It's a safe bet that Obama will claim New Jersey when the results are tallied in the early hours of Wednesday, however people are allowed to vote. ®

Bootnote

1New Jersey features in seven citations on Spamhaus's ROKSO database of spam operations. New York, by comparison, gets 73 and California, 72. Nonetheless there's a suspicion that more than a few spammers live in New Jersey, making the spam DDoS a slightly more plausible threat than might otherwise be the case.

Update

Matt Blaze has been in touch to say:

I argued no such thing, and indeed have never argued any such thing. I simply said that the question is whether the risks are outweighed by the benefits. And then I went on to list many ways in which they would not.

You are characterizing me as having a position that is opposite of what I believe, and I would appreciate a correction.

New hybrid storage solutions

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.