Security Analysis of the Democracy Live Online Voting System

Democracy Live's OmniBallot platform is a web-based system for blank ballot delivery, ballot marking, and (optionally) online voting. Three states-Delaware, West Virginia, and New Jersey-recently announced that they will allow certain voters to cast votes online using OmniBallot, but, despite the well established risks of Internet voting, the system has never been the subject of a public, independent security review. We reverse engineered the client-side portion of OmniBallot, as used in Delaware, in order to detail the system's operation and analyze its security. We find that OmniBallot uses a simplistic approach to Internet voting that is vulnerable to vote manipulation by malware on the voter's device and by insiders or other attackers who can compromise Democracy Live, Amazon, Google, or Cloudflare. In addition, Democracy Live, which appears to have no privacy policy, receives sensitive personally identifiable informationincluding the voter's identity, ballot selections, and browser fingerprintthat could be used to target political ads or disinformation campaigns. Even when OmniBallot is used to mark ballots that will be printed and returned in the mail, the software sends the voter's identity and ballot choices to Democracy Live, an unnecessary security risk that jeopardizes the secret ballot. We recommend changes to make the platform safer for ballot delivery and marking. However, we conclude that using OmniBallot for electronic ballot return represents a severe risk to election security and could allow attackers to alter election results without detection. the online voting option available to voters with disabilities, calling the move "a pilot for if we need to use it more broadly in the future" [26] . West Virginia allows not only the disabled but also military voters and residents overseas to vote online using OmniBallot [38] . Most significantly, Delaware [23] offers OmniBallot online voting to all voters who are sick or who are self-quarantining or social distancing to avoid exposure to SARS-CoV-2-practically the entire state [13, 23] . Increasing voter access is a laudable goal. Voters who are sick, disabled, or stationed overseas sometimes face substantial obstacles to participation, and the coronavirus pandemic threatens to disrupt in-person voting for everyone. However, elections also face substantial risks from cyberattacks-risks that are magnified when delivering or returning ballot online. Election officials have the complicated job of weighing these risks in light of the access needs of their constituencies. For online voting, the consensus of election security experts and national security experts is that the risks are unacceptable. Numerous studies of Internet voting systems used or slated for use in real elections have uncovered critical security flaws (e.g., [25, 28, 30, 48, 49, 61] ). The National Academies of Science, Engineering, and Medicine concluded that "no known technology guarantees the secrecy, security, and verifiability of a marked ballot transmitted over the Internet," and that, "[a]t the present time, the Internet (or any network connected to the Internet) should not be used for the return of marked ballots" [40] . In light of Russia's attacks on U.S. election infrastructure during the 2016 presidential election, the Senate Select Committee on Intelligence has recommended that "[s]tates should resist pushes for online voting," including for military voters [58] . As recently as May 2020, the Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, U.S. Election Assistance Commission, and National Institute of Standards and Technology privately warned states that "electronic ballot return technologies are high-risk even with [risk-mitigation] controls in place," and that attacks "could be conducted from anywhere in world, at high volumes, and could compromise ballot confidentiality, ballot integrity, and/or stop ballot availability" [60] . Despite these risks, to our knowledge, OmniBallot has never been the subject of a public, independent security review, 3 and there is little public documentation about its functionality. Democracy Live even claims that the online ballot return capability should not be considered Internet voting at all, but rather a "secure portal" or "document storage application" [43] . (In fact, it completely matches the definition of Internet voting as used by security experts [1] and by the Election Assistance Commission [56] .) These factors make it difficult for voters, election officials, and other policymakers to understand whether the technology is safe. In this paper, we present the first public, independent analysis of OmniBallot's security and privacy properties. We obtained the portion of the software that