West Virginia’s mobile voting pilot: Voatz in 2018 and the security reviews that followed

West Virginia’s mobile voting pilot let eligible military and overseas (UOCAVA) voters return ballots through the Voatz smartphone app, first in two counties in the May 2018 primary and then in 24 counties in the November 2018 general election, where the vendor reports 144 ballots were submitted.⁠^1,3 In 2020, an MIT analysis and a vendor-commissioned Trail of Bits audit found serious weaknesses, including that the system was not end-to-end verifiable and that anyone controlling its servers could alter or deanonymize votes; West Virginia moved to a different system with paper ballot output for its 2020 primary.⁠^1,2,4

In plain words

People serving in the military or living abroad often struggle to vote. Mailed ballots can take weeks. West Virginia’s Secretary of State wanted to make it easier, so in 2018 the state tried a phone app called Voatz. Voters proved who they were by scanning an ID and taking a short video selfie, marked a ballot on the phone, and sent it in. Each ballot was later printed on paper at the county and run through normal counting machines.

The company said the app was secure because it used blockchain, fingerprints, and other technology. But it did not publish how the system worked. In 2020, researchers at MIT studied the app from the outside and said attackers could learn or change votes. Then a security firm hired by Voatz itself studied the full code and found 48 problems, including that whoever ran the servers could change votes, and that the system did not let voters truly check their votes. West Virginia stopped using Voatz and chose another system.

Defined terms

• UOCAVA voters. Uniformed services members, their families, and overseas citizens covered by the Uniformed and Overseas Citizens Absentee Voting Act. Federal law requires states to offer electronic delivery of blank ballots to them, but not electronic return.⁠⁸
• Electronic ballot return. Sending a marked ballot over the internet, by app, portal, email, or fax. A 2020 federal guidance document addresses its risks;⁠⁷ this site’s security chapter quotes that document’s conclusion that electronic ballot return is high risk.
• Permissioned blockchain. A replicated ledger run by approved nodes. It can make records harder to alter after they are written, but it does not show that what was written matches what a voter intended.
• End-to-end verifiability (E2E-V). Voters can check their ballot was recorded as intended and anyone can check the tally, without trusting the software or operator. See audits and verification.
• Side channel. Information leaked by how a system behaves (timing, message length) rather than by its content.
• Black box versus white box review. A black box review studies a system from the outside (here, the public Android app); a white box review has the source code and infrastructure.

What happened

West Virginia’s pilot grew from Secretary of State Mac Warner’s goal of making voting easier for UOCAVA voters. A paper coauthored by Voatz’s CEO and published through the National Association of Secretaries of State says the state signed a memorandum of understanding for a pilot in two counties for the May 2018 primary, where “there were under 20 voters”.⁠³ For the November 2018 general election the pilot expanded to 24 counties.⁠³

After the election, the Secretary of State’s office disclosed that during the pilot rollout “the application vendor identified activity that could have been an attempt to gain uninvited access to the system,” and referred it to the U.S. Attorney’s Office; the office said “no votes were altered, impacted, viewed or in any way tampered with”.⁠⁵ The office explained that it used “uninvited” rather than “unauthorized” because the latter “requires a legal conclusion, which has not been made”.⁠⁵

On February 13, 2020, an MIT team publicly released a preprint of the first public security analysis of Voatz.⁠¹ Trail of Bits, engaged by Tusk Philanthropies and Voatz on December 18, 2019, issued its assessment dated March 12, 2020.⁠² On March 3, 2020, Nextgov reported that West Virginia would not use Voatz in its May 2020 primary and would instead use Democracy Live’s OmniBallot portal for overseas, military, and disabled voters, with each vote producing an auditable paper ballot.⁠⁴ The state’s deputy secretary, Chuck Flannery, said “the public concerns, as well as our concerns about security were things that were certainly of consideration”.⁠⁴ Voatz said it “respectfully” acknowledged the state’s needs and described the West Virginia pilot as “markers of success”.⁠⁴

How it worked

The Voatz process in West Virginia, as the vendor describes it, began with the state’s voter registration system: counties marked which UOCAVA voters who had asked for electronic ballot delivery were eligible.⁠³ Voters downloaded the app, scanned both sides of a driver’s license or state ID or the photo page of a passport, and took a video “selfie” for facial matching; they then tied their biometric identity to the phone so that “a voter can only vote on one device and that a device can only be used by one voter”.⁠³ The MIT team found that identity verification used a third party service, Jumio, which received the ID images and photo.⁠¹

After marking and submitting the ballot, the vendor says, the app notified the state’s voter history system, generated an anonymous voter ID, submitted the encrypted vote to a blockchain of 32 servers split between two cloud providers, and sent anonymous receipts to the voter and to the Secretary of State.⁠³ A voter could ask the Secretary of State’s office to spoil a ballot and vote again; the vendor notes that “spoiling a ballot necessitated the loss of voter privacy”.⁠³ When polls closed, county staff used two secure thumb drives to unlock the votes, which were assembled into PDF files, printed on cardstock with the anonymous ID, and scanned on the county’s certified tabulators.⁠³ The post-election audit compared counts of voters, ballots, receipts, and ballot styles, and matched receipts with printed ballots by anonymous ID.⁠³

The printed ballots were copies of what the servers produced. The paper record therefore recorded what the system said voters chose, not something voters themselves marked or checked on paper.

Evidence: measured findings

West Virginia’s participation numbers come from the vendor’s paper:⁠³ in the 24 counties, 183 eligible voters had requested electronic delivery; 160 (87 percent) downloaded the app; 147 (92 percent of those) authenticated and received a ballot; 144 submitted ballots (98 percent), from 31 countries counting the United States; one ballot was spoiled. These figures are vendor reported; this review found no separate official tabulation.

The MIT analysis, by Michael Specter, James Koppel, and Daniel Weitzner and published at the 29th USENIX Security Symposium in August 2020, reverse engineered the Android app and built a clean room server, never connecting to Voatz’s servers.⁠¹ Its findings:⁠¹

• An attacker with root access to a voter’s device could disable the app’s malware detection, learn the voter’s choices, and alter the vote.
• A completely passive network observer could potentially recover a voter’s secret ballot from the length of encrypted messages, a side channel; an active attacker could block submission in response.
• The app showed no indication that it received or validated any blockchain record, so “any use” of the blockchain was unlikely to protect against a malicious server, which likely “has full power to observe, alter, and add votes.”
• Identity verification and other third party services received sensitive data, including photos and location related data, without clear disclosure.

Before publication, the researchers coordinated disclosure through CISA; they report that Voatz “disputed the severity of the issues” but “appeared to confirm the existence of the side channel vulnerability, and the PIN entropy issues”.⁠¹

The Trail of Bits white box review was larger in scope: five engineers over twelve person weeks, with access to server, Android, iOS, and administrative code.⁠² It reported 48 findings, “of which a third are high severity,” concerning cryptography, data exposure, and data validation.⁠² Key conclusions:⁠²

• “Anyone with administrative access to the Voatz backend servers will have enough information to fully reconstruct the entire election, deanonymize votes, deny votes, alter votes, and invalidate audit trails.”
• Clients “do not connect directly to the blockchain themselves, and are therefore unable to independently verify that their votes were properly recorded.”
• Asked whether Voatz is E2E-V, the report answers “No,” and that a voter cannot independently verify that a receipt is valid.
• On the mixnet described in Voatz’s FAQ: “There does not appear to be, nor is there mention of, a mixnet in the code”; “the core server has the capability to deanonymize all traffic, including ballots.”
• On February 27, 2020, after reviewing proposed fixes, “eight (8) issues were addressed, and forty (40) issues remain partially or fully unfixed.”

Trail of Bits stated that its conclusions reflect “the security of the Voatz solution, not mobile voting in general,” and that review of past election proceedings was out of scope.⁠²

Failures and criticisms

West Virginia’s pilot drew criticism first for opacity. The MIT authors write that Voatz “declined to provide formal details, citing the need to protect their intellectual property,” and that when a University of Michigan researcher analyzed the app in 2018, the company reported the incident to authorities and the FBI investigated the researcher.⁠¹ They argue that “open access to their code, system design, and running test implementations would have likely revealed these flaws rapidly”.⁠¹

The bug bounty program drew criticism as a substitute for transparency. MIT notes that it excluded network interception attacks and attacks requiring physical access to a device, and that it denied safe harbor unless researchers waited until Voatz declared a fix deployed.⁠¹ The authors report that HackerOne later removed Voatz’s bug bounty from its platform.⁠¹

The verification design was criticized because both the receipt and the printed ballot came from the same system. Trail of Bits found that voters could not independently verify receipts and the public could verify neither the tally nor eligibility.⁠² MIT also warned that the app did not require re-entering a PIN after registration, creating coercion risk for a voter whose device could be unlocked by fingerprint, as in intimate partner abuse.⁠¹ See intimidation.

Voatz disputed the MIT findings. The MIT authors report that Voatz called them flawed and that its CEO continued to deny their veracity after the Trail of Bits audit; they state that the Trail of Bits analysis “confirms the veracity and severity of all findings reported here” and affirmed “there were no security relevant differences” between the app MIT examined and the internal master.⁠¹ They also report that Voatz claimed they had examined an outdated version of the app.⁠¹ This page reports that exchange as the MIT authors describe it; it did not review Voatz’s own blog post directly.

Competing interpretations

The access case. The vendor’s paper cites a Federal Voting Assistance Program estimate that overseas citizens’ 2016 voting rate was 6.9 percent, compared with 72 percent for voting age citizens in the United States,⁠³ and argues the pilot showed high completion among those who started. Supporters of mobile voting, including Voatz backer Bradley Tusk as quoted by MIT, frame the trade as “solving for the problem of turnout” rather than zero technology risk.⁠¹ The Secretary of State’s office pointed to audits that “all resulted in positive results”.⁠⁵

The integrity case. Critics respond that the pilot’s audits could only compare outputs of the same system, so they could not detect server side manipulation that Trail of Bits found possible.⁠² The MIT authors argue the choice “is not about turnout, but about an adversary controlling the election result and a loss of voter privacy,” and that software independent systems with voter verified paper ballots and risk-limiting audits “remain the most secure option”.⁠¹ The National Academies (2018) recommended against internet voting at present.⁠⁶

A middle reading. Small scale pilots for voters who otherwise face real barriers can be defended as experiments, if the system is open to review, the scale is capped, and independent verification exists. West Virginia’s pilot had small scale but, according to both reviews, lacked the other two conditions.⁠^1,2 Compare Switzerland’s legally required code publication (Swiss e-voting trials).

Lessons

These are interpretations drawn from the record.

1. Technology labels are not security properties. Blockchain, biometrics, and device checks did not, per both reviews, provide verifiability or resistance to a malicious server.⁠^1,2
2. A paper printout of a digital ballot is not a voter verified paper ballot. It records the system’s claim. See hardware.
3. Identity proofing is not ballot integrity. Strong ID checks answered “who is voting” but not “was the vote recorded as cast.” See identity and registration.
4. Transparency should precede deployment. Independent review arrived after the 2018 use, not before.
5. Officials can change course. West Virginia switched systems within weeks of the findings becoming public.⁠⁴

Application to this framework

West Virginia’s pilot is a direct caution for the “My vote” part of the My Vote Forward framework. The framework holds that private voting requires secrecy and verification that do not depend on trusting the operator, and that official remote voting is a research and requirements program rather than a feature (see private voting). The Voatz record shows why a vendor’s claims, even with audits, cannot substitute for that.

The case also bears on the framework’s data rules. The framework treats identity data, priorities, opinions, and ballots as separate classes with separate protections (see privacy). In the Voatz system, Trail of Bits found that the core server could deanonymize ballots,⁠² which is the linkage between identity and ballot that the framework says must never exist.

Unresolved questions

• What did the four independent security reviews of the 2018 pilot, cited by the vendor, actually examine and find? Their reports were not available in this review.
• What happened to the 2018 “uninvited access” referral? The sources reviewed state no legal conclusion.
• Did mobile voting raise participation among overseas voters, or shift voters from other electronic channels? The pilot data cannot answer that.
• Can any remote voting design give overseas voters both speed and verification independent of the operator, and at what cost?
• How should states evaluate vendors who restrict research through intellectual property claims or bug bounty terms?