Isn’t online voting insecure?

For official ballots, yes: in 2018 the National Academies of Sciences, Engineering, and Medicine concluded that “Internet voting should not be used at the present time,” and United States federal agencies have rated electronic ballot return high risk even with safeguards. My Vote Forward does not dispute that conclusion and does not offer online official voting. Its online parts are advisory priority rankings and optional opinions, which carry different and lower stakes than a ballot, and its long-term interest in secure private voting is stated as a set of unmet requirements, not a finished capability.

The objection in its strongest form

The objection to My Vote Forward on security says that the computer security research community has examined internet voting for decades and has repeatedly found it unsafe. A ballot cast over the internet passes through a voter’s device, which may be infected; a network, which may be attacked; and servers, which may be compromised by insiders or outsiders. Unlike a bank transaction, a secret ballot cannot be checked by the voter against a receipt that shows how they voted, because such a receipt would enable vote buying and coercion. So errors and attacks can go undetected. Public demonstrations have shown real systems compromised within days.

The critic adds that framing matters. A project named “My Vote Forward” that talks about secure private voting, passkeys, and phones will be read by many people as promoting phone voting, whatever its fine print says. Even advisory online tools can normalize the idea that voting online is safe, and that normalization has political consequences.

Why the objection matters

Security matters for My Vote Forward because the framework’s credibility depends on not overclaiming. If the project implied that its demo was a safe model for official voting, it would mislead readers on a question where experts have reached a firm conclusion. The objection also matters because trust in elections is fragile; see trust in elections. A civic project that blurred the line between advisory participation and official voting could damage confidence in the official process.

Defined terms

• Internet voting: casting an official ballot over the internet, from a personal device or a networked machine.
• Electronic ballot return: sending a marked ballot back to election officials electronically, by email, fax, or web portal. Some United States jurisdictions allow it for limited groups of voters.
• Software independence: a property of a voting system in which an undetected change in software cannot cause an undetectable change in the outcome; usually achieved with voter-verified paper. See voter-verified paper record.
• End-to-end verifiable voting: systems that let voters check their ballot was recorded and counted without revealing how they voted. See end-to-end verifiable voting.
• Advisory participation: input that informs an institution but has no legal effect, such as a ranking of priorities.

Evidence

The strongest United States statement is the National Academies report “Securing the Vote” (2018). Its recommendations include that “Internet voting should not be used at the present time,” that ballots marked by voters “should not be returned over the Internet or any network connected to it,” that “Elections should be conducted with human-readable paper ballots,” and that states should mandate risk-limiting audits.⁠¹

Federal agencies reached a similar conclusion. Verified Voting’s summary of consensus studies reports that the Cybersecurity and Infrastructure Security Agency, the Election Assistance Commission, the FBI, and NIST, in their guidance on risk management for electronic ballot delivery, marking, and return, rated electronic ballot return “high-risk” even with safeguards and recommended paper ballots.⁠² The same summary reports that the Senate Select Committee on Intelligence found in 2019 that “no system of online voting has yet established itself as secure,” and that a 2022 NIST report on promoting access to voting found “significant security, privacy, and ballot secrecy challenges”.⁠² Verified Voting is an advocacy organization that favors paper ballots; the underlying documents are government reports.

A concrete demonstration came from Washington, D.C. In 2010, the D.C. Board of Elections and Ethics opened a pilot internet ballot return system to public testing. A University of Michigan team reported that “within 36 hours of the system going live, our team had found and exploited a vulnerability,” replaced cast ballots with write-in votes of its choosing, and installed a back door to see later ballots together with voters’ names.⁠³ Officials took the server down after testers noticed the team’s calling card, a university fight song played on the confirmation page, and the Board announced it would not proceed with live electronic ballot return “at this time”.⁠³ See the D.C. 2010 case.

Other countries have proceeded cautiously rather than not at all. Switzerland’s Federal Chancellery reports that “Since 2004, 15 cantons have offered internet voting to a limited part of their electorate in over 300 trials,” under a policy of “security before speed,” and that current cantons use a system “with complete verifiability” examined by independent reviews, with licenses valid only for a limited share of the electorate.⁠⁴ Estonia has used internet voting since 2005; in the 2023 parliamentary election, 313,514 people voted online, 51.1% of participating voters and 32.5% of the 966,129 eligible voters.⁠⁵ Estonia’s system has critics as well as defenders; see the Estonia case and the Swiss trials case.

How comparable systems have handled it

The comparable systems divide into three approaches.

• Do not use it. The United States consensus position for general elections, with paper ballots and audits.⁠¹
• Use it narrowly with verifiability and caps. Switzerland’s approach: limited electorate shares, a verifiable system, and independent examination.⁠⁴
• Use it broadly with national digital identity. Estonia’s approach, in use since 2005.⁠⁵ and built on national electronic identity. Its rules for replacing an earlier online vote, which are meant to reduce coercion, are discussed in the Estonia case. See also can a household coerce a remote voter?.

None of these approaches is a priority-ranking tool. They are all official voting systems with legal authority behind them.

Competing interpretations

One view, reflected in the National Academies report, holds that internet voting is unsafe for official elections with current technology, full stop⁠¹ On this view, cryptographic research may change the answer someday, but policy should follow demonstrated security, not promises.

A second view holds that the risk is a matter of degree and context. Supporters of Estonia’s and Switzerland’s programs argue that verifiability, national identity infrastructure, and careful limits make internet voting acceptable for their settings, and that refusing it has costs for overseas, disabled, and remote voters.

A third view separates official voting from advisory participation. On this view, the security standard for an official ballot, where one changed vote can alter who holds power, is different from the standard for a ranking of public priorities that has no legal effect. Advisory tools still need integrity, but an attack on them is closer to manipulating a survey than to stealing an election.

What the framework answers

My Vote Forward takes the first view for official voting and the third view for its own advisory parts.

• No official voting. The websites and demo do not cast or count official votes. The demo uses simulated data. See status.
• Advisory parts are labeled as advisory. Priorities and opinions inform; they do not decide. See the framework.
• Secure private voting is a requirements list, not a product. The framework’s private voting chapter lists what any future official system would need, including legal authorization, independent evaluation, paper or equivalent independent records, and audits, and says those conditions are not met.
• Expert conclusions are reported as they are. The framework does not cite security guidance as approval of itself. NIST or EAC documents describe standards; they do not endorse this project.

Where the objection still wins

The objection wins on framing. A project that discusses phones, passkeys, and “private voting” will be read by some people as promoting phone voting, whatever its disclaimers say. The objection also wins on the long-term ambition: the framework says it is interested in real, authorized private voting someday, and the best current expert guidance says the technology for doing that safely over the internet does not exist.⁠¹ Until it does, that part of the framework is an aspiration, and the honest description is “not recommended under current conditions.” Finally, even advisory systems can be attacked, and an attacked advisory result can still mislead; see won’t bots flood it?.

Unresolved questions

• What security standard is proportionate for advisory priority-setting that institutions may cite?
• Would verifiable cryptographic voting systems change the expert assessment, and what evidence would be needed?
• Should the framework’s long-term ambition for private voting be restated as purely in-person or paper-based until experts say otherwise?
• How can a project discuss future voting technology without normalizing unsafe practice?

Related

• Security
• Private voting
• Audits and verification
• Is this an official voting service?
• What happens when the network fails?
• Hard questions