E-Mail Voting Comes With Risks; Pentagon Warned on Security Issues for Overseas Ballots

washingtonpost.com
E-Mail Voting Comes With Risks
Pentagon Warned on Security Issues for Overseas Ballots
By Ellen Nakashima
Washington Post Staff Writer

Time was when soldiers, if they wanted to vote, had to request ballots by snail mail, fill them out and return them the same way.

The process typically took weeks.

This year, thousands of soldiers around the world have the opportunity to vote in the Nov. 7 elections by e-mail. It's part of a Pentagon effort to make it easier for overseas military personnel to cast ballots in federal and state elections, and it reflects how the Internet has changed life in the combat zone.

But computer security experts inside and outside the government warned that the Pentagon's Federal Voting Assistance Program ignores the risks associated with unencrypted e-mail: interception, hacking and identity theft.

"E-mail traffic can flow through equipment owned and operated by various governments, companies and individuals in many countries," Joel Rothschild, a Navy Reserve captain, said in an August report prepared for the Pentagon. "It is easily monitored, blocked and subject to tampering."

A separate report by four outside computer security experts released last week raised similar red flags and added that the use of unencrypted e-mail for registering overseas voters invited identity theft.

"No bank would ask their customers to send Social Security numbers over unencrypted e-mail," said the report's co-author, David Wagner, a professor of computer science at the University of California at Berkeley. But that is what the system allows, he said.

Rothschild's report noted that e-mails can be encrypted to reduce tampering risks. Pentagon officials said states would need to arrange for that provision.

States have options for getting ballots to and from voters. They can fax, e-mail or mail the ballots, or use a combination of the methods. The federal government began the use of faxed ballots in 1990, with troops stationed in the Persian Gulf for Operation Desert Shield. E-mail is an option in those states that allow it; at the moment eight do. Mississippi was the first, allowing troops overseas to vote by e-mail in a 2003 gubernatorial election.

Neither the Pentagon nor state officials say they track how many of the 294,000 military personnel overseas are voting by e-mail. That information is held at the county level, state elections officials said.

Anecdotally, the number of military personnel voting by e-mail appears limited.

In Colorado, Jefferson County elections official Shawna Weir said she has received three ballots that soldiers sent by e-mail. The service members -- two in Iraq and one on a ship -- e-mailed their ballots to a federal facility in Virginia, which then faxed them to the county.

They were all "very eager to vote," Weir said, noting that they had called her to make sure they could get their ballots.

The combination of faxing and e-mail "is about as dangerous as you can get," Wagner said. "It's got all of the problems with unencrypted e-mail, plus your ballot is being routed through the Department of Defense. Will soldiers feel free to vote their conscience when they know that the DOD may be able to see how they voted? How do we know that the DOD or their contractors haven't modified soldiers' ballots in transit?"

J. Scott Wiedmann, deputy director of the Federal Voting Assistance Program, said the operators at the federal facility cannot alter e-mail content, which is sent in "read-only" format. Voters are also encouraged to mail in an original copy of their ballot as a backstop, he said.

Soldiers faxing and e-mailing their ballots also must sign waivers saying they understand that somebody might see their ballot, Wiedmann said. "There's no U.S. constitutional guarantee to a secret ballot," he said.

Joni Ernst is a county elections official in Iowa and a major in the Iowa Army National Guard who served in Iraq from 2003 to 2004. She delivered mail to the troops and saw how long it could take, so she is glad that soldiers have the e-mail option. Most every camp has an Internet cafe for soldiers, and if the voting process is simple, she said, the troops are more likely to vote.

"Their time is very limited," Ernst said. "We don't want to detract from the mission. But we want to make sure their vote counts."