Utah County, Utah, begins review of mobile-app votes

Officials from Utah County, Utah, said Wednesday that the percentage of overseas voters who participated in last month’s local primary elections using a mobile app far outpaced the rate of in-county residents, which the officials chalked up as a win for a new voting technology that is being gradually tested around the country, despite misgivings from ballot-security proponents.

During an hour-long meeting that was broadcast on Facebook, Amelia Powers Gardner, Utah County’s clerk and auditor, said that 22 of her constituents who were on active-duty military deployments or otherwise out of the country used the app, Voatz, to submit ballots for the Aug. 13 elections, out of 58 people eligible to do so. While a small sample size, it represents a 38 percent participation rate among those voters, compared to the 24 percent participation rate by in-county residents who submitted their ballots through the mail.

“I’m excited about this because all citizens regardless of where they reside deserve the right to vote,” Powers Gardner said at the meeting, which kicked off a public audit of the mobile ballots. “And this shows that when we give them the option of convenience and a safe and secure private ballot, they take advantage of it.”

The Voatz app, which uses blockchain encryption, has been tested in previous contests in West Virginia and Denver, where its use was paid for by venture capitalist Bradley Tusk. (Tusk has investments in several companies developing distributed-ledger technology, though Voatz is not part of his portfolio.) Tusk also funded Utah County’s use of the app.

To begin the auditing process, Powers Gardner’s deputy, Josh Daniels was joined by Forrest Senti of the National Cybersecurity Center, a nonprofit organization in Colorado Springs that also reviewed Denver’s use of Voatz in May.

Voatz, which uses multifactor authentication — including facial recognition — to verify eligible users, claims to be more secure and efficient than other electronic means of submitting a vote, including anonymizing them to preserve the privacy of the individual ballot. Completed ballots are transmitted to the relevant elections board, where they can be printed out locally and counted with the rest of the votes.

Daniels and Senti proceeded to review a handful of the Voatz-submitted ballots, which were identified only as long strings of numbers and letters, with each string taking up one or two blocks along Voatz’s proprietary blockchain. The blocks, they showed, contained “payloads” written in base-64 text, that were then fed into a decryption tool that spit back shorter numerical strings, each of which was meant to match up to a candidate that the voter selected. Daniels and Senti then compared the results from each decrypted block against the corresponding digital receipt to confirm that the chosen candidates matched.

While Daniels and Senti did not find any errors in the small batch of ballots they checked, mobile balloting, particularly that conducted by Voatz, has been scrutinized as lacking the same protections as a voter-verified paper ballot.

“Blockchains do not provide ballot secrecy,” says a paper published last year by the National Academies of Sciences, Engineering, and Medicine.

But Powers Gardner and Daniels defended Voatz, saying it offered more reliability than other forms of voting from abroad, including physical mail, email and fax machines — none of which offer complete anonymity. Daniels called the app a virtual ballot-marking device that “creates a degree of transparency.”

The audit itself is ongoing, with the National Cybersecurity Center opening the process to volunteers, Senti said.