Online voting still too risky, cybersecurity expert says

We’re not ‘sophisticated enough as a society to manage the responsibilities’

CAMBRIDGE — Online voting is not a secure way for electors to choose a new government, says the chief technology officer of a Cambridge-based cybersecurity firm eSentire.

“As a technologist and someone who is very concerned about the integrity of our elections, I would not be a fan or supportive of any electronic voting system,” said Mark McArdle.

Online voting is expected to be used by 150 to 200 Ontario municipalities in the next round of municipal elections in October 2018.

One of those cities will be Cambridge, which allowed online voting and telephone voting for a two-week advance voting period in 2014. In the next election in 2018, Cambridge will expand early voting to three weeks, and allow internet and telephone voting on election day.

McArdle works out of eSentire’s headquarters on Pinebush Road. The company, which employs more than 250 people in Cambridge and 50 in offices in New York City and Ireland, protects more than 600 clients around the world from hackers and malware.

Paper ballots are better than virtual ones, said McArdle.

“I think the paper system, while anachronistic — it has flaws of its own — at the end of the day you have a paper ballot, you can count them again, you can count them a third time,” he said.

“And with electronic systems, and the attack surfaces that electronic systems bring into play, I don’t think we are sophisticated enough as a society to manage the responsibilities that come

along with that effectively.”

Look no further than the United States to see the chaotic fallout that ensued following accusations and reports that Russian hackers meddled in last fall’s presidential election.

Russian hackers are said to have used phishing emails to trick leaders of the Democratic Party into opening attachments that contained spyware. The Russians are also accused of passing along a trove of 20,000 secret emails from the Democratic National Committee, through third parties, to Wiki Leaks founder Julian Assange.

There are reports that Russian hackers created false stories about Hillary Clinton that were widely distributed on social media. For months, Washington has been preoccupied with congressional hearings, investigations and accusations about Russian hackers and the presidential election.

“We see what’s happened in the U.S., how big a distraction this has been,” said McArdle.

“The thing that is most frustrating out of all the discussions I am seeing about the Russian hacks and all the various investigations, they haven’t even gotten close to talking about how this happened, and what can be done about preventing it going forward,” he said.

All of this should be a cautionary tale for online voting. In Canada, online elections are held at the municipal level only in Ontario and Nova Scotia.

In Ontario, 12 municipalities had online voting in 2003. That increased to 20 in 2006. It more than doubled to 44 in 2010, and expanded to 97 during the last municipal elections in 2014.

Nicole Goodman, director of research at the Centre for e-Democracy at the University of Toronto, studied internet voting at 47 municipalities in the 2014 elections. She surveyed voters and election officials.

“There are concerns around security, but I have to say they are a minority,” said Goodman. “For the most part it seems they accept any security concerns as being part and parcel of taking part in online activities.”

Goodman’s husband is a computer programmer and, like many in that sector, he is opposed to online voting because the internet is not secure, she said.

She said standards need to be developed around security for online voting. She hopes to work with computer scientists and the City of Toronto to research how internet voting can be made more secure.

“Definitely, computer scientists will explain to you the risks associated with it, and that’s certainly why we haven’t seen internet voting at higher levels of government,” said Goodman.

“Because as you go up, people associated a greater degree of importance with higher level elections, and hackers would have a greater incentive to try and compromise one of those elections,” she said.

Secret ballots in elections are the heart of democracy, and McArdle is waiting for the day when the practice of democracy can be entrusted to the internet.

“I am a geek at heart, and I want to embrace technology in all places it can improve quality of life, but there are some vital systems that need to be hardened to a point that we haven’t demonstrated as a society enough sophistication to do that well,” he said.