Delaware backs out of mobile voting weeks before primary

Delaware election officials backed off a plan to offer an online ballot-return method to voters in its primary next month, citing a recent report from security experts that found that the platform being used is vulnerable to hacking that could expose or manipulate how a person’s ballot was cast without being detected by either voters or the vote counters.

The platform, OmniBallot, allows election administrators to send ballots to hard-to-reach voters, like deployed military members, civilians living abroad and voters with disabilities, giving them the option to return their completed ballots through a variety of methods, including postal mail, email and fax. But Delaware was also one of a handful of states that planned to test out OmniBallot’s ability to transmit ballots online, which raised concern with some election security analysts who argue that the internet is a dangerous venue for voting.

In a June 7 paper, J. Alex Halderman, a computer scientist at the University of Michigan, and Michael Specter, a doctoral student at the Massachusetts Institute of Technology, wrote that OmniBallot “is vulnerable to vote manipulation by malware on the voter’s device and by insiders or other attackers” who can compromise software made by OmniBallot’s developer, Democracy Live.

The decision by Delaware officials to drop OmniBallot as an option in the state’s July 7 primary was first reported by Delaware Public Radio.

Along with New Jersey and West Virginia, Delaware opted into a pilot project funded by advocates of mobile voting. New Jersey offered OmniBallot to its overseas and disabled voters in local races last month, but does not plan to use it again in its presidential primary, also scheduled for July 7.

But Delaware officials went beyond their counterparts in the other two states and also made OmniBallot an option to voters who are self-quarantining out of concern of becoming infected with COVID-19. Delaware, like many other states since the pandemic started, has greatly expanded the use of mail-in absentee ballots, but it still collected more than 2,700 ballots through the online method before state Election Commissioner Anthony Albence decided to cut it short. (Those votes will still be counted, officials said.)

Albence told Delaware Public Radio the report about the software’s vulnerabilities raised concerns that the public would not find it trustworthy.

“We have confidence in the system, but we want everyone to be fully confident in anything that we do,” he told the station.

Delaware voters can still receive their absentee ballots electronically, print them out, complete them and mail them back using a state-operated service. But the state will continue offering the option for ballots to be returned electronically using Egress Switch, a secure document-transfer platform that other Delaware agencies use for transferring information.

While Delaware dropped OmniBallot, West Virginia Secretary of State Mac Warner said Monday that his state’s use of the platform in last week’s primary election was a success, with 180 voters — including 25 with qualifying disabilities — in 26 different countries, returning their ballots electronically.

Halderman and Specter wrote in their paper, though, that voters’ “safest option is to avoid using OmniBallot,” opting instead for a printed absentee ballot that travels via physical mail.

Still, every election sees tens of thousands of military personnel and other overseas voters return their ballots electronically, usually via email or fax, which are both permitted under the federal government program that facilitates expat voting. Meanwhile, the Department of Homeland Security and other agencies continue to warn against electronic forms of voting, writing in a memo last month that “electronic ballot return technologies are high-risk even with controls in place.”