Feeds

US election: New Jersey email voting plan 'best of bad bunch'

Better to give a man two votes than none

Next gen security for virtualised datacentres

Security watchers have given a lukewarm backing to plans by New Jersey authorities to allow email voting for residents of the state left displaced by Superstorm Sandy.

New Jersey Lieutenant Governor Kim Guadagno issued a directive on Saturday permitting voters to download absentee ballots before returning them by either email or fax in order to cast their vote, as previously reported.

"I'm not filled with confidence, but this seems like the best of a bunch of bad alternatives," commented security guy Bruce Schneier, in a brief blog post.

Robert David Graham of Errata Security is even more negative: "Is anybody taking bets on how much the vote-by-email will exceed the population in New Jersey?"

There are some safeguards in place to prevent this scenario, as Ed Felten of Princeton's Center for Information Technology Policy explains:

"Although the order does allow a ballot to be submitted by email or fax, this is subject to the submission of a signed hardcopy ballot, and the law directs election officials to compare the electronic ballot with the eventually received hardcopy," he writes on the Freedom to Tinker blog.

Unless it's encrypted, email isn't secure. By default email can be easily spoofed or intercepted and read. That's why sending password reminders by email is a no-no. The medium is a total non-starter for anything more sensitive.

Computer scientist Matt Blaze argues the use of email for voting is undesirable but justifiable in the midst of the aftermath to a national disaster.

"The security implications of voting by email are, under normal conditions, more than sufficient to make any computer security specialist recoil in horror," Blaze, a computer scientist at the University of Pennsylvania, explains. "Email, of course, is not at all authenticated, reliable, or confidential, and that by itself opens the door to new forms of election mischief that would be far more difficult in a traditional in-person polling station or with paper absentee ballots.

"If we worry that touchscreen 'DRE' electronic voting machines might be problematic, email voting seems downright insane by comparison. But a knee-jerk reaction to the worst case scenario is probably not helpful right now. Clearly, email voting is risky. The question is whether these risks outweigh the benefits, and whether the technical and procedural safeguards that are in place are adequate to mitigate them under these rather unique circumstances."

Even supporters of internet voting more generally are skeptical that the effort will go smoothly without running into problems, such as individuals attempting to vote multiple times or potential denial-of-service attacks from spammers1, Politico reports.

Changes in voting laws have facilitated email and fax voting for overseas voters and military personnel since 2010. However only 3,500 ballots were cast this way in the mid-term elections to Senate and Congress and there is some concern that the approach is not ready for prime time.

The scheme could potentially service hundreds of thousands of votes, Charles Stewart, co-director of the Cal Tech-MIT Voting Technology Project, told Politico. It would be better to allow displaced New Jersey residents to cast their vote in Tuesday's presidential and Senate races using provisional ballots at any polling station close to where they have been relocated, Stewart argued.

Separate directives issued over the weekend enable displaced voters and emergency relief workers to vote by provisional ballot at a polling place in a county other than the voter’s county of registration.

New Jersey hasn't voted Republican in presidential elections since 1988, when the state went for George Bush (senior). It's a safe bet that Obama will claim New Jersey when the results are tallied in the early hours of Wednesday, however people are allowed to vote. ®

Bootnote

1New Jersey features in seven citations on Spamhaus's ROKSO database of spam operations. New York, by comparison, gets 73 and California, 72. Nonetheless there's a suspicion that more than a few spammers live in New Jersey, making the spam DDoS a slightly more plausible threat than might otherwise be the case.

Update

Matt Blaze has been in touch to say:

I argued no such thing, and indeed have never argued any such thing. I simply said that the question is whether the risks are outweighed by the benefits. And then I went on to list many ways in which they would not.

You are characterizing me as having a position that is opposite of what I believe, and I would appreciate a correction.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Super Cali signs a kill-switch, campaigners say it's atrocious
Remote-death button bad news for crooks, protesters – and great news for hackers?
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.