Online security experts warn against online voting

Security experts have a message for election officials in the Northwest Territories: don’t use online voting.

Officials recently announced online voting will be used for the first time in a provincial or territorial election when residents go to the polls on Oct. 1. Voters will be able to cast their ballots online using the Montreal-based Simply Voting platform.

It’s an idea that has garnered a lot of public excitement, as well as criticism.

“It’s really sexy. It gets you in the papers, it gets you on CBC,” says government transparency advocate and OpenNWT founder David Wasylciw.

“But there’s a lot more issues when you talk to computer security people. Every single one of them says it’s a terrible idea. Everybody who does computer work says it’s a terrible idea.”

Security experts say that while hacking from foreign actors is a threat, what people in the territory should be most concerned about is ballot transparency.

Wasylciw says this apparent lack of transparency can be exacerbated in a place like the N.W.T., where many ridings have only a couple hundred voters, and outcomes can come down to a few dozen votes.

“[With paper elections] a candidate can scrutinize the votes and they can count them and double check them. With an online system, none of that’s even an option. All you get is a spreadsheet.”

Scrutinizing ballots

Aleksander Essex, a professor of computer science at Western University in London, Ont., who studies online voting, agrees. He says the biggest issue with the technology is there is no assurance that the recorded votes are actually what voters chose.

In a traditional paper ballot, voters use a pencil to mark their vote and place it in a box to be counted at the end of the day, often in front of several scrutineers. If there’s a discrepancy, the votes can be recounted by hand several times.

“The paper that goes into the box can’t disappear or change shape. It’s not like the pencil lead can disappear then reappear in another oval,” Essex says

“But in the digital world it’s possible for that to happen.”

Essex says it’s caused major problems in some Ontario municipalities that have used online voting. Candidates who were reported to have lost questioned the accuracy of the votes that came in from online voting.

“Maybe the numbers were completely correct and the polls just kind of misled them or maybe something went wrong,” he said.

“They can’t tell the difference.”

He was part of a team that studied technology used in the 2018 municipal elections in Ontario, and he evaluated several online voting programs, including Simply Voting.

Using a demo website, Essex says he was able to create and install a browser plugin that changed what people saw on their screens when voting on the Simply Voting site. The name of Candidate A was changed to the name of Candidate B, which meant voters could accidentally vote for the wrong candidate.

Essex says plugins like those can be applied to most voting software.

“People don’t seem to understand that the things they see on their screen and the things that get sent to the server are not necessarily the same thing.”

Secure ballot box

When asked for comment on Essex’s concerns, Elections NWT referred CBC to Simply Voting.

Brian Lack, president of Simply Voting, told CBC he’s never heard of a plugin being used to interfere with an election on his platform, including a 2016 plebiscite on electoral reform in Prince Edward Island.

He admits they are hard to detect and impossible to combat, but he doesn’t see them as a threat to an election as small as the N.W.T.’s.

“It’s very, very difficult to, number one, develop a plugin or a virus and have it either installed or infect enough computers to make any difference in the outcome. You would need to get it installed on enough PCs of eligible voters of the Northwest Territories to make an impact,” Lack says.

“The KGB or the CIA, they have the ability to roll out viruses and infect hundreds of thousands of people, but given the scope of the types of projects that Simply Voting works on, it’s not a reasonable threat.”

After the election is over, N.W.T. officials will be provided with a spreadsheet breaking down the votes per candidate per poll.

“The voting system has two parts: it has a list of eligible voters and it also has a secure ballot box that’s anonymous,” Lack said.

He says Simply Voting also has an option where, when voters cast their vote electronically, they are given a receipt code. They can put that into the Simply Voting website to make sure their vote was recorded correctly.

However, Lack says, Elections NWT has declined to use the receipt code option. The raw contents of the digital ballot box will be provided to Elections NWT.

Lack also says that one tool for auditing the internet vote will be to compare online vote tallies to paper tallies.

“If there are differences in demographics… that of course could create a difference in voting trends if elder voters are more likely to vote one way versus young voters,” he said in an email.

“However, the absence of any major or unexpected difference between paper and internet tallies would indicate that it’s unlikely the internet votes were manipulated.”

Essex says, regardless of whether the results on the spreadsheet are accurate, it could still come down to candidates’ comfort level.

“If there turns out to be a contentious election and the person who loses decides that they didn’t lose and they decide they’re going to fight it, then you better be ready for [a] very interesting possibly Supreme Court challenge,” he said.

“So, I wish everyone in the Northwest Territories all best. I wish for the election to go smoothly, but you need to know that this might be what is waiting for you. ”