Dear Editor,
I'm writing to express my concern with the integrity of the online voting system in place for the upcoming City of Owen Sound municipal election. Now that electors are receiving their voter cards, a number of serious issues have arisen:
There are numerous reports of electors receiving voter cards for people who do not live in their household. These cards can be used with only the recipient's date of birth as verification. In some cases, the DOB is known, as the extra card is for a family member who no longer lives here and will not be voting here. There doesn't seem to be anything but good faith preventing the use of these extra cards.
It seems that anyone can obtain a voter's card by simply declaring online that they are an Owen Sound voter. In one case I am personally aware of, a person who is not a citizen of Canada and is ineligible to vote was able to obtain a voter card in this way. They don't intend to use it; the point is that they—or anyone else—could quite easily register and receive a card they are not entitled to use.
Changing over from paper ballots to online voting is largely a matter of convenience and reducing expenses. However, we can't do this at the expense of a fair, valid election.
People will say, "online voting has been happening elsewhere for a decade now." There's a big difference between electronic voting in a controlled environment, though, and online voting from any device with an Internet connection.
More than 350,000 electronic voting machines are in use across the United States, and they use two types of technology to record votes. The first is a touchscreen. Identity is verified by poll workers, and the voter essentially creates a 'digital ballet' through their interactions with the machine. The second is an optical scanner system. Identity is verified by poll workers and the elector fills out a paper ballot, which is then fed into a scanner, thereby creating the digital ballot. You may recognize this as the system used in our recent provincial election here in Ontario.
Did you notice what's missing in the system we're expected to use in this election?
Who/what is verifying the identities of voters to ensure that each elector gets but one single vote, and that each vote cast is valid?
I've been writing about technology for over a decade, and covered the 'National Strategies for Trusted Identities in Cyberspace' program for a tech publication called Search Engine Watch back in 2011/12. Back then, the US government was testing out the abilities of various tech companies, including Google and Facebook, to provide identity verification services. The project was called OpenID 2.0, and the bare bones requirement to attain Level 1 was that a user could register for an online service and provide no proof of identity whatsoever. This would allow you to create a Gmail address or a Facebook account, for example.
In order to achieve Level 2, the tech company/identity provider needed to be able to verify a user's ID using "single factor remote authentication using a wide range of available authentication technologies." In plain English, you had to scan in some form of official documentation such as a driver's license, and swear a declaration that it was yours.
I'm looking back at that now wondering how on earth it is that the verification requirements were more stringent for verifying your identity to Facebook in 2011 than they are in our municipal election in 2018?
What's more, we are outsourcing our online voting to a publicly-traded American company, Dominion Voting. We have no line of sight into how our personal data is being stored or treated. The laws we rely on here in Canada to protect our data integrity don't necessarily apply when that data crosses borders. I'd urge voters to grab a coffee, search "dominion voting problems" on Google and do some reading. And remember, these reported issues are largely with electronic voting systems that are not connected to the Internet, that are inside polling stations where other methods of identity verification are taking place.
We seem to have gone straight from paper ballots to being the guinea pigs in an experimental
online system that's seriously lacking in even basic identity verification process. Credit card companies have been mailing your unique PIN out separately from your credit card for years, but Dominion Voting has both your Voter ID and PIN in a single letter. Anyone in possession of a letter with an ID and PIN can vote, regardless of how that was obtained. We're not even doing so much as it took to convince Facebook you were a real person five or six years ago.
It's not enough to say, "That won't happen here," or "People wouldn't do that." Owen Sound's own website was taken down by hackers not that long ago, and there have been a string of hackings-for-ransom in small Ontario municipalities recently. Elections large and small have been tampered with recently. I don't believe that Owen Sound has the resources or can shoulder the expense of a forensic audit if the results of this election are called into question.
It's a serious question that deserves serious consideration from the City immediately, not after the votes are counted.
Sincerely,
Miranda Miller