Paper Info
Title
Security Analysis of the Democracy Live Online Voting System
Abstract
Democracy Live's OmniBallot platform is a web-based system for blank ballot delivery, ballot marking, and online voting. In early 2020, three states-Delaware, West Virginia, and New Jersey-announced that they would allow certain voters to cast votes online using OmniBallot, but, despite the well established risks of Internet voting, the system has never before undergone a public, independent security review. We reverse engineered the client-side portion of OmniBallot, as used in Delaware, in order to detail the system's operation and analyze its security. We find that OmniBallot uses a simplistic approach to Internet voting that is vulnerable to vote manipulation by malware on the voter's device and by insiders or other attackers who can compromise Democracy Live, Amazon, Google, or Cloudflare. In addition, Democracy Live, which had no privacy policy prior to our work, receives sensitive personally identifiable information-including the voter's identity, ballot selections, and browser fingerprint-that could be used to target political ads or disinformation campaigns. Even when OmniBallot is used to mark ballots that will be printed and returned in the mail, the software sends the voter's identity and ballot choices to Democracy Live, an unnecessary risk that jeopardizes the secret ballot. We recommend changes to make the platform safer for ballot delivery and marking. However, we conclude that using OmniBallot for electronic ballot return represents a severe risk to election security and could allow attackers to alter election results without detection. In response to our findings, Delaware and New Jersey halted their use of OmniBallot for online voting, but it remains available in other jurisdictions, as do similar tools that likely face the same serious risks.
Year
Venue
DocType
2021
PROCEEDINGS OF THE 30TH USENIX SECURITY SYMPOSIUM
Conference
Citations 
PageRank 
References 
0
0.34
0
Authors
2
Name
Order
Citations
PageRank
MA Specter100.34
J. Alex Halderman22301149.67