Top threats to online voting from a cybersecurity perspective

Last year, NASA set up an online voting campaign to pick a name for an astronomical object, a small ice-covered asteroid roving through a remote part of the Solar system. Although the New Horizons space probe has yet to take a picture of it, thousands of people have thus learned about the newly discovered astronomical entity. This is a great example of how a trivial push of a button to choose an appealing denomination can engage people and enhance their awareness. Welcome to the world of online voting!

This fundamental process, also referred to as electronic voting or e-voting, revolves around enabling users to express their opinion and make a choice. This is an inalienable and extremely important privilege, even if it boils down to dubbing boulders in outer space. Regardless of the sphere and goals, voting has always been associated with errors, manipulation, and sabotage. As this process has migrated online, new threats have emerged, and so have the prerequisites for a higher level of security. To make the average modern voting system secure, it makes sense to identify the potential cyber threats and vulnerabilities of this routine and come up with countermeasures. Here are some takeaways from such an analysis.

The bizarre new world

The very essence of online voting implies the use of a dedicated Internet platform and digital devices. This method has numerous benefits, including the ability to engage many people, the convenience, and reliability of the whole process, as well as automated calculation of the results.

However, just like any Internet-borne procedure, e-voting can be prone to certain risks. Some of them have their offline counterparts, such as the sale of votes. Others are inherent to the digital environment only. The latter include breaches and DDoS attacks. Furthermore, since the poll takes place without direct surveillance, there is an elevated risk of coercion into participating.

Insights into this relatively new domain have uncovered several issues that need to be addressed before launching any online voting platform. Of course, the top priority in this scenario is to secure the authentication workflow.

Threats to online voting process

An ineffective voter authentication procedure can have an adverse effect upon the reliability of the entire online voting system. Numerous security incidents related to e-banking and online payment transactions demonstrated that compromising an authentication system can cause large-scale frauds and data theft. Online voters can run this type of risk if their devices are infected with malicious code that steals login credentials, or in case they fall for a phishing scam imitating a registration or voting form. Both scenarios can lead to the theft of votes. Regardless of the approach used for authentication and user identification, it must be backed by dependable protection mechanisms.

Besides, there is a risk of tracking. Electronic voting can enable threat actors to identify the participants through their devices or IP addresses, which endangers people's anonymity. It's imperative to tackle this problem within any online voting platform because a likely identity disclosure can even put a person's life at risk.

Coercion to vote can be one more problem. It's hard to grasp the actual intentions of an individual who is voting remotely with their smartphone. In this case, an online voting system that allows changing one's choice multiple times could be the solution. The voter's final pick would be considered the relevant one. Such an approach might also address the issue of votes being sold. The mercantile hallmarks of potential vote sale vanish altogether if it's easy for a person to alter their choice.

In a paradigm where voting data is stored online – possibly in the cloud – there is a risk of perpetrators getting hold of preliminary results and using them to manipulate the general upshot of the poll. End-to-end encryption of all the information allows thwarting this scenario as long as several people or a specific organization keep the decryption keys.

Meanwhile, a breached server can be configured to deflect the votes in favor of a particular candidate during the voting and the poll results calculation process. Ballots designed according to the black box principle could be a good countermeasure in this case. They would transmit the encrypted vote information so that no one can learn the contents of these messages. It's noteworthy that this technique would in no way tangle the process of summarizing poll results.

Other caveats related to electronic voting include the forgery of certificates leveraged to authenticate users and register their votes, as well as the theft of private keys in pursuit of fabricating the votes of individual participants or entire groups of them. Encryption and a well-thought-out protection routine spanning all the mechanisms and systems used in the voting process will be critical for preventing issues like that.

Threats to devices used for voting

The devices people use to participate in electronic voting, such as smartphones or personal computers, are susceptible to a bevy of cyber menaces. These include malware attacks, physical damage, and data theft, to name a few. Whoever organizes the e-voting process should, therefore, adopt a security system aware of the fact that some users don't protect their devices properly and don't do enough to safeguard the data stored on them with reliable passwords or specially crafted software. In other words, organizers should make sure all voters' devices are reliably protected.

Threats to online voting platforms

The attacks that target e-voting platforms proper or Internet and telecommunications service providers sustaining their operation are probably the most dangerous and destructive of all possible threats.

Let's exemplify this impact with a DDoS attack, which may be accidental in some cases. It is likely to affect the accessibility of a voting platform or completely knock it offline. If the process of submitting votes becomes too slow, the failure that occurs due to this delay can make itself felt during the user identification and login routine. This means people will be unable to vote.

To counter this vector of disrupting an online voting campaign, some organizations opt for DDoS mitigation services. While this approach sounds like a good call, there is one significant pitfall in doing so. Such a service operates as a TLS (transport layer security) proxy to inspect all web traffic streaming towards a server and filter out malicious packets. Such an action implies that the traffic between the users and the server can be decrypted, which is a security issue right there. Technically, the DDoS mitigation workflow is an authorized MITM (man-in-the-middle) attack.

Another critical issue with this protection technique is that the TLS encryption key used by an anti-DDoS entity resides on multiple servers across the world. Consequently, if a threat actor succeeds in compromising one of these servers and obtains the key, they will most likely be able to interfere with the voting results. Effectively, this is a system with a single point of failure.

While this technique might be suitable for a commonplace organization running some sort of an e-voting initiative, governments that may be targeted by high-profile attackers cannot afford to sacrifice voters' privacy this way.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

The inevitable future

The world is changing, and the number of Internet users is constantly growing. More and more people prefer to do business, communicate, and solve their mundane tasks online.

Electronic voting is a logical next stage in the evolution of the traditional voting process. It helps solve the problem of low turnout and ensure that people who cannot participate in offline voting for whatever reason still get the chance to express their opinion. Electronic voting gets communities, universities, companies, and conference attendees together. All that's left for us to do is safeguard this novel process against any potential threats so that the world can fully enjoy all its benefits.