City website privacy concerns raised

Election site is secure, city officials assure

A city voter says he’s concerned the city’s webpage for online voting lacks even the most basic security measures, although the city says he’s mistaken — the online voting system is perfectly secure.

Dylan Radcliffe isn’t so sure, though — and he says he won’t vote online.

On Tuesday, he was reading questions someone else posted to social media about the city webpage that allows you to register to vote online. The person had concerns about the site’s security.

When Radcliffe checked it out, he says he found the webpage doesn’t use an SSL certificate.

“It’s really, really basic security that the page doesn’t have,” Radcliffe said in an interview Tuesday.

To lack this level of security is “super-irresponsible,” Radcliffe said, given that people are being asked to upload personal information to the site to prove their residence status — and then later they’ll vote via this page.

A secure sockets layer (SSL) certificate is a form of online identification that ensures the site belongs to the organization it claims to belong to (in this case, the City of Peterborough). It also encrypts information that it receives online.

Without an SSL certificate, Radcliffe said the city’s voting page is “left wide open to attack.”

Any computer-savvy person could “in theory be harvesting users’ data,” Radcliffe said: redirecting the data to another site, for example, or rewriting the city’s website to add fake voting locations.

Or not: Nick Powers, the manager of IT security for the city, says all information provided through the city’s election website, peterboroughvotes.ca, is secure.

He provided a detailed email following The Examiner’s lateafternoon request for information.

Powers wrote that the city’s election website uses the secure voterview.ca site for voter lookup information. Online voting, on the other hand, will be done through a system called Dominion Voting.

“While these services may look like they’re on peterboroughvotes.ca, they are actually on the previously mentioned secure external sites,” Powers writes.

“This currently isn’t clear to the public that uses the website, so the city is taking the extra step of upgrading the security certificate relating to peterboroughvotes.ca even though no private or confidential information exists there,” he wrote.

Power wrote that the city is also undertaking third-party testing of the online voting system in advance of the municipal election on Oct. 22.

“The lack of an SSL certificate is not directly related to an individual’s ability to take control of a website,” Powers added. “There are additional security controls on login and administrative functions.”

Powers also offered to speak directly with any citizens who has concerns about online voting.

“We take security extremely seriously,” he wrote.

Radcliffe received a tweet in reply to his concerns on Tuesday, from the city’s Twitter account, that explained this briefly.

The tweet stated that the information being fed into the city’s site is getting funneled to the secured site voterview.ca.

“That’s where the information is actually being entered, even though it appears like it’s on our site,” the tweet reads, in part.

But Radcliffe said he’s not convinced the site is secure.

“The issue isn’t the third-party site,” he said. “This is just basic-level security stuff.”