Mobile-voting firm balks at Oregon senator’s concern over security

Voatz, the company behind a mobile app that’s been used by several jurisdictions to collect ballots from overseas voters in recent elections, defended on Friday recent warnings from officials and election security experts about adopting the new technology. Responding to a letter in which Sen. Ron Wyden, D-Ore., asked officials in his home state to reconsider using Voatz this year, the company said such a notice “increases the fear of technology” being used in the democratic process.

In his letter, which was first reported Thursday by the Washington Post, Wyden wrote to Oregon Secretary of State Bev Clarno of his misgivings with two counties’ plans to offer Voatz to their deployed military and overseas voters, mentioning previous warnings about online voting.

“Election security experts have uniformly warned against the practice of voting over the internet and have instead urged the use of hand-marked paper ballots,” Wyden wrote, citing in particular a 2018 report from the National Academies of Sciences that recommended that all elections be conducted offline and on paper.

Wyden has been skeptical before of Voatz, which boasts of using blockchain encryption technology to secure and transmit the votes it collects back to the election authorities who contract with it. Last November, he asked the Defense Department to audit Voatz’s app. Both that request and Thursday’s letter appear to have been prompted by two counties in central Oregon — Jackson and Umatilla — announcing plans to start using the app to serve their overseas registered voters. Voatz says it has started participating with the Department of Homeland Security’s National Cybersecurity Assessments and Technical Services team, which conducts security assessments and penetration testing. (The company also already participates in a third-party bug-bounty program that rewards white-hat hackers who find vulnerabilities.)

But in its response to Wyden’s letter, Voatz reiterated previous defenses of its product as being secure, and being a good option for voters abroad, who have previously used it to send ballots back to West Virginia, Denver and Utah County, Utah. The app is offered as an alternative to other methods provided by the Uniformed and Overseas Citizens Absentee Voting Act, the 1986 federal law that established guidelines for how registered voters stationed abroad can send ballots back home. Aside from postal mail, the act has allowed voters to transmit their votes via fax or email, both of which can have the effect of removing the anonymity of the individual ballot, whereas Voatz says its software anonymizes its users’ preferences before they can be printed out and counted at the appropriate election bureau.

“The bottom line is that mobile voting offers significantly better security, reliability and accessibility when compared to many of the existing options available to our military servicemen, women, and citizens living overseas,” the company’s statement read. “We have conducted more than 50 successful elections (public and private) in the last three years, some of which have involved active attempts to break-in that have all been thwarted in real-time. This is a reflection of a system that works as intended: one that safeguards against attempted attacks and allows us to empower jurisdictions to help keep our country’s critical infrastructure resilient.”

Wyden wrote in his letter that Oregon’s status as a state that votes almost exclusively by mail gives it “some of the most secure and accessible elections in the United States.” But its system could be more secure, he said, if the state reconsiders a 2011 law that made it one of 24 states to permit overseas voters to return ballots over the internet.

“While the cybersecurity risks may have been less clear in 2011,” he wrote, “they are crystal clear today.”

Voatz said it has not been contacted by Wyden directly, but that it would be open to working with him “to clarify any misperceptions.” In its statement, though, the company went on to accuse the senator of stoking fear about its technology.

“It is our humble opinion that efforts to shut down these pilots are aimed at locking our elections infrastructure in a loop of exclusion, paranoia and fear — the very sentiments that tear down our elections infrastructure and thwart the efforts toward election resilience and trust,” Voatz’s statement read.

A spokesperson for Clarno, the Oregon secretary of state, confirmed to StateScoop that her office received Wyden’s letter, but said any changes to the 2011 law allowing online voting are up to the state legislature. Still, the spokesperson added that Clarno is mindful of the cybersecurity concerns around new platforms like Voatz.

“We’re open to technology,” the spokesperson said. “We need to make sure our elections are as secure as possible. We’re not willing to sacrifice security for something shiny.”