-
by Dustin McGregor
This election cycle, The City of Owen Sound made the unfortunate decision to use online voting provided by Dominion Voting Systems(DVS). Legitimate results cannot be obtained due to the simplicity of voter fraud to more complex problems that, for example, could allow an attacker to change votes on the fly. There are also unresolvable privacy issues out of the control of the City or DVS.
It isn't possible to prevent an individual from voting multiple times. Similarly there is nothing to prevent giving or selling a PIN to another. Little could have prevented someone from traveling around town stealing voter information packages when they were initially sent out. More importantly it is impossible to detect that any of the above happened.
The privacy of electors can be infringed by anyone monitoring a wireless connection and would be even easier with access to a shared device. Malware will often allow screens or keyboard strokes to be monitored. Legitimate software routinely deployed in the workplace can do the same. Even if we trust that the DVS system is secure we cannot trust each individual device in use.
It places the burden of ballot secrecy almost entirely on the elector.
Like myself, many will be voting at a Help Centre. If the Help Centre systems have not had an independent security audit they cannot be trusted to guarantee the secrecy and security of the vote.
A paper produced for the City of Toronto in 2014 audited 3 systems including that built by DVS. The authors conclude that "no proposal provides adequate protection against the risks inherent in internet voting" and recommended the City not use it in any capacity.
In 2018 security researcher, Zach Aysan published an extensive analysis of the PC leadership vote conducted by DVS. His research revealed that they did not mitigate man in the middle attacks, exposed PIN numbers to third parties, could not guarantee secrecy of the ballot and discovered serious but easily remedied security holes. I used the same tool to confirm the holes he discovered in March remain today.
If DVS can't employ security basics can we trust their system at all?
The truth is that we can't.
To be fair it isn't only their system. No system can mitigate all of the security and privacy concerns raised. Toronto concluded that in 2014 and continue to use paper ballots in 2018. Aysan and other researchers have been saying the same for years. Like me, others are saying it as well.
There should be no question that an electors vote is secure, inalterable and ballots are kept secret. Democracy hinges on these principles and when they cannot be guaranteed our entire electoral system becomes untrustworthy. As a result no elected official can ever claim legitimacy making the election itself virtually meaningless.
