Requests for absentee ballots are on the rise ahead of the November election — the first general contest since learning of Russian efforts to access voting systems, including those right here in the Washington area.
But critics, including a host of computer security experts, say a system designed to make voting easier also makes it more of a target for hackers intending to interfere in U.S. elections. Maryland officials, however, argue those concerns are hypothetical and say they've put the necessary safeguards in place.
At issue is Maryland's online ballot delivery system, which allows any voter to request and download an absentee ballot from the internet. Maryland doesn't allow residents to vote online, so users of this system must mail in their ballots.
Forty-seven states limit electronic ballot delivery to voters who absolutely need it, primarily military and overseas civilians, or voters with disabilities. But Maryland is one of three states that allow anyone to request ballots electronically. In 2016, nearly 90,000 voters used the electronic ballot delivery system, according to state data. More than 80 percent were not were military or overseas.
Mary Kiraly, a former member of the Montgomery County Board of Elections, said that as a military wife, she knows how important electronic ballot delivery is for service members, overseas civilians or the disabled. But she also said, "When we open it up to every voter, then it becomes a huge target and the concern grows exponentially."
George Washington University professor Poorvi Vora agrees. She's among the computer security experts who have repeatedly warned the state elections board and legislators that Maryland is "one of the most vulnerable states in the U.S. for major election tampering." This year, she testified in support of a bill in the Maryland General Assembly that would have limited the access to military, overseas voters and the disabled, but it failed to advance.
Vora argues the data needed to request the electronic ballot, such as a name, date of birth or driver's license number, can be obtained online or through prior data breaches. She said it wouldn't be hard for hackers to identify people who haven't voted in years, request ballots in their name and have those ballots delivered to fraudulent email addresses.
"If the voter doesn't show up, they don't even know that someone voted for them," Vora said. "And the state doesn't know."
Nikki Charlson, deputy state administrator of the Maryland State Board of Elections, said the state has considered these very scenarios and put necessary safeguards in place — measures she wouldn't divulge because of security concerns.
"I can't go into the list of all the unusual behavior that we look for because I'm giving away the keys to the castle," Charlson said.
After a contentious battle, the Maryland General Assembly opened it up to all voters in order to increase voting accessibility. In the years since, no voter has complained of getting a ballot they didn't request, Charlson said, and the state can detect if and when a person's ballot is voted twice.
"Voters can be confident that if they need the convenience or need the accessibility to get their ballot that way, that they can do that and know with confidence that the ballot's secure," she said.
Still, the elections board acknowledges some risk. Voters who download ballots are warned online that the state "cannot guarantee secrecy" if they choose to mark a ballot online, "nor can it protect against all risks when using the internet."
Charlson said the online ballot delivery system was critical for Maryland's first responders who deployed to help after Superstorm Sandy, because they didn't have a physical address to receive traditional absentee ballots by mail.
"What's convenient for one person is a necessity for somebody else," said Charlson.
Vora, the George Washington University professor, has also criticized Maryland for not using signature verification to check absentee ballots downloaded online. Washington and Alaska, the only other states which offer online ballot delivery to all voters, do compare the signature on the returned ballot with the signature on file from when the voter first registered.
The courts have called the value of signature matching into question, however, and Charlson said the General Assembly would need to authorize the elections board to require it. She also noted absentee ballots comprise just six or seven percent of all turnout — a fraction of many Western states.
Critics point to federal indictments of Russian military officers, accused of meddling in the 2016 presidential election, as evidence attempts to interfere will only continue.
Federal authorities say Russian hackers tried to access election systems in 21 states, including Maryland, in the run up to the 2016 election. Charlson told the I-Team it was the state's own cybersecurity team that first detected unusual activity and reported it to the FBI and the Department of Homeland Security. The hackers were not able to tap into the state's networks.
Maryland officials were surprised earlier this year, however, to learn about Russian investment in one of its elections vendors. The Department of Homeland Security has found no evidence of wrongdoing, though critics have seized on that connection as another worrisome sign.
Eric Hodge, head of election security for CyberScout, a company that advises and consults with states and counties about their cybersecurity measures, said his primary concern isn't that bad actors will try to change votes — but sow chaos and shake voter confidence.
Hackers could launch a phishing scheme in which they send a fake email to voters who've used the online system in past elections, he said, and offer a link to a fake ballot for the upcoming election. Those voters might think they voted and wouldn't show up on Election Day.
"The best thinking in the FBI and the CIA is this is an effort from the highest levels of these adversarial governments to undermine the strength or the confidence or the faith in democracy and our voting process," Hodge said.
State officials say the best way Maryland residents can protect their ballot is to go to the state's website ahead of time, create an account and make sure their personal information is correct, including their email address. Voters with concerns about electronic ballots should use a traditional paper absentee ballot, which is mailed to their home and thus harder to intercept, Charlson said.
Asked if the state can assure the system is wholly secure, she said, "I can tell you that we've put in place all the right things. We look for the right things. But it would be irresponsible for me to say it's 100 percent secure, because nobody can [say] that."
Reported by Jodie Fleischer, produced by Katie Leslie, edited by Jeff Piper, and shot by Jeff Piper, Steve Jones and Chester Panzer.
