Feeds

US election: New Jersey email voting plan 'best of bad bunch'

Better to give a man two votes than none

Reducing security risks from open source software

Security watchers have given a lukewarm backing to plans by New Jersey authorities to allow email voting for residents of the state left displaced by Superstorm Sandy.

New Jersey Lieutenant Governor Kim Guadagno issued a directive on Saturday permitting voters to download absentee ballots before returning them by either email or fax in order to cast their vote, as previously reported.

"I'm not filled with confidence, but this seems like the best of a bunch of bad alternatives," commented security guy Bruce Schneier, in a brief blog post.

Robert David Graham of Errata Security is even more negative: "Is anybody taking bets on how much the vote-by-email will exceed the population in New Jersey?"

There are some safeguards in place to prevent this scenario, as Ed Felten of Princeton's Center for Information Technology Policy explains:

"Although the order does allow a ballot to be submitted by email or fax, this is subject to the submission of a signed hardcopy ballot, and the law directs election officials to compare the electronic ballot with the eventually received hardcopy," he writes on the Freedom to Tinker blog.

Unless it's encrypted, email isn't secure. By default email can be easily spoofed or intercepted and read. That's why sending password reminders by email is a no-no. The medium is a total non-starter for anything more sensitive.

Computer scientist Matt Blaze argues the use of email for voting is undesirable but justifiable in the midst of the aftermath to a national disaster.

"The security implications of voting by email are, under normal conditions, more than sufficient to make any computer security specialist recoil in horror," Blaze, a computer scientist at the University of Pennsylvania, explains. "Email, of course, is not at all authenticated, reliable, or confidential, and that by itself opens the door to new forms of election mischief that would be far more difficult in a traditional in-person polling station or with paper absentee ballots.

"If we worry that touchscreen 'DRE' electronic voting machines might be problematic, email voting seems downright insane by comparison. But a knee-jerk reaction to the worst case scenario is probably not helpful right now. Clearly, email voting is risky. The question is whether these risks outweigh the benefits, and whether the technical and procedural safeguards that are in place are adequate to mitigate them under these rather unique circumstances."

Even supporters of internet voting more generally are skeptical that the effort will go smoothly without running into problems, such as individuals attempting to vote multiple times or potential denial-of-service attacks from spammers1, Politico reports.

Changes in voting laws have facilitated email and fax voting for overseas voters and military personnel since 2010. However only 3,500 ballots were cast this way in the mid-term elections to Senate and Congress and there is some concern that the approach is not ready for prime time.

The scheme could potentially service hundreds of thousands of votes, Charles Stewart, co-director of the Cal Tech-MIT Voting Technology Project, told Politico. It would be better to allow displaced New Jersey residents to cast their vote in Tuesday's presidential and Senate races using provisional ballots at any polling station close to where they have been relocated, Stewart argued.

Separate directives issued over the weekend enable displaced voters and emergency relief workers to vote by provisional ballot at a polling place in a county other than the voter’s county of registration.

New Jersey hasn't voted Republican in presidential elections since 1988, when the state went for George Bush (senior). It's a safe bet that Obama will claim New Jersey when the results are tallied in the early hours of Wednesday, however people are allowed to vote. ®

Bootnote

1New Jersey features in seven citations on Spamhaus's ROKSO database of spam operations. New York, by comparison, gets 73 and California, 72. Nonetheless there's a suspicion that more than a few spammers live in New Jersey, making the spam DDoS a slightly more plausible threat than might otherwise be the case.

Update

Matt Blaze has been in touch to say:

I argued no such thing, and indeed have never argued any such thing. I simply said that the question is whether the risks are outweighed by the benefits. And then I went on to list many ways in which they would not.

You are characterizing me as having a position that is opposite of what I believe, and I would appreciate a correction.

Maximizing your infrastructure through virtualization

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.