Rhode Island governor signs bill allowing internet voting

Rhode Island Gov. Daniel McKee last week signed legislation that could allow some of the state’s registered voters to cast their ballots over the internet, despite concerns raised by election officials and critics of electronic voting.

The new law, S2118, calls for giving deployed military service members, citizens residing overseas and people with physical disabilities the ability to receive and submit their ballots online. While the legislation passed the Rhode Island General Assembly earlier this year with comfortable margins, it raised criticisms from election-security advocates who’ve long said that submitting votes over an internet connection could imperil the secret ballot.

“The landscape of the internet hasn’t really changed much since the early 1990s,” said C. Jay Coles, a senior policy associate at Verified Voting. “The internet wasn’t designed as a secure space.”

Under the new Rhode Island law, eligible voters could request an electronic ballot if the secretary of state’s office approves a system that’s gone through “one or more independent security reviews” and meets the scrutiny of the cybersecurity framework published by the National Institute of Standards and Technology.

Rhode Island Secretary of State Nellie Gorbea has in previous election cycles used an electronic vendor, Democracy Live, to send eligible voters their ballots, which were then collected through either postal mail or drop-boxes. Gorbea — who is currently challenging McKee for the Democratic Party’s gubernatorial nomination — initially backed the new bill when it was first proposed last year, but dropped her support amid opposition from the state Board of Elections and outside groups.

Democracy Live’s technology does include the option of returning completed ballots to election officials over a web portal. While Rhode Island has not used that feature in the past, four states allow overseas voters to cast their votes over a web portal, and more than a dozen others have allowed some voters to return their ballots through a fax machine or email, according to the National Association of State Legislatures.

Democracy Live also hired a former Rhode Island legislator as a statehouse lobbyist, the Providence Journal reported last month.

In a letter to McKee last week urging the governor to veto the bill, Verified Voting and other groups accused the legislation of being deceptive about how voting systems are assessed and certified. While NIST’s cybersecurity guidebook is considered an industry benchmark for protecting data, it’s the U.S. Election Assistance Committee — an agency not mentioned in the Rhode Island legislation — that certifies voting systems.

“The legislation is worded to present a false sense of security,” the letter reads.

Internet-enabled voting has been made available in small pilot projects in a handful of states, including West Virginia, Colorado, Utah and Washington. And while those projects have stood up to post-election audits, broader skepticism of online balloting remains strong.

Both NIST and the EAC signed onto a 2020 memo by the Cybersecurity and Infrastructure Security Agency stating that ballots cast over the internet post “significant security risks to the confidentiality, integrity, and availability of voted ballots” that “could be manipulated at scale” if intercepted by a malicious actor.

Coles said now that McKee has signed S2118, Verified Voting and similarly aligned groups will urge the secretary of state’s office not to approve any online-ballot systems.

“We want voters to have the easiest time possible in voting while not compromising security,” he said.