Lax Online Security Appears to Allow Cancelling Other Voters’ Mail-in Ballots in Some States

By: - October 18, 2020

Election security in some states is so lax that people can spy on other people’s mail-in ballot process and possibly even cancel their ballots with only basic personal information easily obtained online.

The online voter portal for Washington State only requires the name and date of birth of a voter for a login. Dates of birth are a matter of public record for many people, either through social media, government and court documents, or Wikipedia pages, not to mention millions of hacked personal records available for sale on the darkweb.

Upon login, a person can view the voter’s registration information and other details, including the registered address and ballot status. The portal also allows voters to request a new ballot, which the person can fill out online, print out, and mail to the election authorities to vote. The ballot package needs to be signed and the signature would be matched by the authorities to the one they have on record.

However, the page warns that “if you continue, a ballot previously mailed to you will be cancelled,” suggesting that somebody can log in and cancel another person’s ballot by requesting a new one.

Washington State voter portal page allowing a voter to request a new ballot online on a computer in Washington State on Oct. 18, 2020. (The Epoch Times)

The Epoch Times contacted a Washington voter who then went through the process for his own ballot, which he recently received in the mail. He verified that the name and date of birth is all it takes to request a new ballot and thus invalidate the current one.

The office of the Washington secretary of state didn’t respond to a request for comment.

A similar issue appears to apply to Oregon, where the voter portal also only requires a name and date of birth for a login. The portal allows the voter to fill out the ballot online, print it, and submit it to election authorities, an Oregon voter contacted by The Epoch Times confirmed. The page says the option is only available to military, overseas, or disabled voters, but there doesn’t seem to be any verification that would prevent other voters from using it and thus potentially invalidate any other ballot they were previously issued.

Epoch Times Photo
Screenshot of the Multnomah County, Ore., ballot filled out online in Oregon on Oct. 18, 2020. (The Epoch Times)

The office of the Oregon secretary of state didn’t respond to a request for comment. The Oregon voter portal appeared to be shut down for maintenance on Oct. 18 for several hours.

Underscoring the potency of the vulnerability, in November 2019, a laptop belonging to a medical contractor that had the personal information of more than 650,000 Oregon residents was stolen. The data included names, social security numbers, as well as “phone numbers, dates of birth and Medicaid ID numbers,” The Oregonian reported.

Both Washington and Oregon hold all-mail elections, meaning ballots are automatically mailed to all registered voters before every election.

The problem with the online voter portals was first spotted by users of anonymous discussion board “Politically Incorrect” on 4chan.org. The board is known for robust open-source research as well as online pranks and offensive posts.

Screenshots posted to the board around Oct. 18 indicated some users took advantage of the vulnerability to log in as Oregon Gov. Ted Wheeler, Oregon Secretary of State Bev Clarno, and others. It’s not clear whether the users went through the whole process of printing new ballots for the officials. The main posts on the board on the subject urged users not to commit voter fraud, but only showcase the vulnerability to publicly expose it.

It’s not clear if other states suffer from the same vulnerability.

The Offices of secretaries of state from several other states, including California, Ohio, Texas, Alaska, Florida, and Pennsylvania, didn’t respond to requests for comment.

Mail Voting Concerns

While Oregon and Washington have conducted all-mail elections for years, some states, such as Nevada and California, are sending ballots to all voters this year for the first time with only several months of preparation. This has sparked concerns over whether the infrastructure in such states is prepared to handle the deluge of mail-in ballots. On top of that, voter rolls are notoriously messy and often include the names of people who’ve moved to different addresses, out of the state, or have passed away. That means the ballots can end up with people not eligible to vote.

Source link