An App For Voting? The Daily Wire Speaks With The Co-Founder Of A ‘Mobile Voting Platform’ For The Midterm Elections, As Well As Two Cyber Security Experts

West Virginia will be the first state to use a new app, or “mobile voting platform,” called “Voatz” during this November’s midterm elections. The app will allow military members serving overseas to vote using their smartphones.

Many cyber security experts are troubled by the idea of smartphone voting, and have voiced their concern to news outlets including The Daily Wire. However, Nimit Sawhney, the CEO and co-founder of Voatz, claims the app is secure and robust.

Here’s how it works. A voter must submit an application to their county clerk, who then vets and approves the application.

According to Sawhney: “If the voter chooses the online, mobile option, the clerk will then enter our system, and the voter will receive the notification to download the app. The voter must then take a picture of the front and back of their ID, then take a live selfie – meaning you have to blink your eyes, move your face up and down, left and right. Facial recognition technology is then used to match the picture to your ID. A manual check is also performed to make sure nothing nefarious has occurred.” Multiple checks are completed, then the “identity is digitized, and protected with a fingerprint or face ID on the voter’s phone. Only then will the voter receive the notification to access their mobile ballot.”

The vote is then “recorded on redundant and geographically distributed servers running open source blockchain software,” according to the Voatz official website. The system doesn’t run on “the public bitcoin blockchain,” but on a “public permissioned blockchain (built on the Hyperledger framework) of verified servers located in the US and Canada.”

CNN reports that Voatz was tested “in two counties during the primary election earlier this year with financial backing from Tusk Montgomery Philanthropies. [West Virginia Secretary of State Mac] Warner’s office said four audits of various components of the tool, including its cloud and blockchain infrastructure, revealed no problems.”

In order to get a fuller picture of the Voatz process and its potential advantages and pitfalls, The Daily Wire spoke with Nimit Sawhney, as well as two cyber security experts, Rebecca Herold and Joseph Steinberg.

According to Rebecca Herold, CEO of consulting firm Privacy Professor, the idea of a voting app might disturb the general public because apps are often viewed as breachable and subject to interference. However, Herold notes that “all technology, if engineered correctly and thoroughly tested, has the possibility of doing great good.”

Steinberg says that although “there may be some potential benefits,” he doesn’t believe that at this juncture, app-based voting is a “good idea.”

Herold is concerned, based on what she’s read, that the Voatz app hasn’t been tested well enough by “objective third parties to ensure that all the risks have been resolved.”

To this concern, Sawhney notes that third parties have indeed tested the app. According to a Tuesday blog post, following the initial trial of Voatz in West Virginia, three entities were brought on to examine the app:

Ingalls Infosec was engaged to conduct penetration testing on the system. Security Innovation was engaged to inspect the source code of the Voatz smartphone application for both iOS and Android. A public HackerOne program has been engaged to continuously analyze and test the implementation of the blockchain network and the mobile applications.

Another concern raised by Herold is that biometrics can be altered. Individuals can use previously recorded video footage, and manipulate the facial expressions to mimic what would be needed for the voter selfie. This type of technology, so-called “deep fakes,” has been demonstrated.

However, Sawhney tells The Daily Wire that each voter selfie isn’t simply run through facial recognition technology, but manually checked by an administrator in order to detect potentially fraudulent activity.

“If there is any doubt, the voter isn’t approved, and they are asked to provide additional information,” he said.

Herold’s next concern is the use of WiFi. If a number of people are using the same WiFi, or if that WiFi is public, “someone can get into your device, get to you data, get into your apps.”

A similar concern is raised by Steinberg regarding malware. “If a device is infected with malware, who says someone can’t manipulate what’s happening on the device, and sending different data than the user intends?” Steinberg asks.

Sawhney responds to this concern by noting that the company runs “significant checks” when it comes to infiltration and malware. He adds that many Android phones are not supported because unlike iPhones, which he says have “relatively very good security,” Android devices often fall short. As such, they cannot perform the same checks as on an iPhone.

“On iPhones, if the device is compromised, it will not allow a person to vote on that device,” Sawhney states. “On Android, only select devices are permitted, and we do similar checks to detect malware or other forms of compromise, like jailbreak.”

The blog post from Tuesday adds more detail:

The Voatz platform goes to significant lengths to prevent a vote from being submitted if a device is compromised. Only certain classes of smartphones that are equipped with the latest security features are allowed to be used. Detecting a compromised mobile network is particularly challenging for a mobile application, which is why ensuring end-to-end vote encryption and vetting the certificates represented by unique IDs stored on the smartphone, are two of the approaches we use to mitigate a compromised mobile network.

Another concern brought up by Steinberg is the potential lack of auditing: “If you vote using a system like this, you have no physical paper trail, which means, as opposed to voting machines, if there is an irregularity, you’re less likely to be able to find it, and you’re going to have a much more difficult time auditing it.”

Sawhney allays this concern by noting that each vote from the app is accompanied by a paper record. “Once the votes go on the blockchain, they also get printed on paper because the tallying process is still paper-based. The county clerks print out the paper, and put them in the ballot scanners. So there is a paper trail.” Additionally, Sawhney says, as a person fills out their ballot on the app, an anonymous digital record is created and stored in a lockbox. This record can be printed and compared to voting records from the clerks for the purpose of auditing.

Steinberg is also concerned that if the blockchain technology is cracked sometime in the future, private voting records could be made public.

To this, Sawhney says there are two types of anonymization, “one on the device before the vote is sent out, and the other on the network.” Moreover, “if the cryptographic protocols on the blockchain get broken in fifteen or twenty-five years, someone could decrypt the vote, but there would be no information about the voter. The information about the voter is on the voter’s device only. So, you would have to preserve that device for fifteen years, break into it, break the software, break the blockchain, figure out which card belongs to which voter, and compare and correlate. Practically speaking, that would be very difficult.”

In the end, this will certainly be a grand experiment in the democratic process. There are potential benefits, but the dangers are extraordinary.