Exposing Vulnerabilities in Online Ballot Issuance
Introduction
The ease of creating ballots online, particularly through platforms like the King County OmniBallot portal, has sparked some debate. A video circulating social media demonstrated how a ballot could be generated using a fabricated voter profile, raising alarms about potential election security vulnerabilities.
Video circulating social media shows how easy it is to create ballots using King County’s OmniBallot portal.
Fake Voter Creation
The central issue highlighted by the video is the capability to produce a ballot using fictitious information. The process involved entering a made-up name, birthdate, and a random King County address into the OmniBallot portal. This demonstration exposed how easily any individual could generate a ballot, potentially undermining the integrity of the electoral process.
VoteWA vs OmniBallot
Ballots can be created using the votewa.gov website. All that is needed is the name and date of birth to produce a replacement ballot. While this has insufficient security protocols, it will still only issue ballots to a verified registered voter, and it will only create the ballot for the address that voter is registered.
UOCAVA Loophole
Washington state law accommodates UOCAVA (Uniformed and Overseas Citizens Absentee Voting Act) voters and does not require them to be registered in order to submit a ballot. This loophole means that anyone selecting UOCAVA status can circumvent standard voter verification procedures. This lack of requisite identification checks opens the door to fraudulent voting activities.
In order to claim UOCAVA status, a voter just needs to check a box. No verification of the voter’s eligibility to vote as a UOCAVA voter is required. It’s another election process that relies on the honor system instead of preventative and protective procedures.
Voters with UOCAVA status do not need to provide their driver’s license number, the last four of their social security number, or any other form of identification. Washington state law allows them to remain a UOCAVA voter until they confirm otherwise with the county elections office. State law also says that a UOCAVA voter may maintain their registration until they register elsewhere. This is not news.
Signature Verification Weaknesses
King County asserts that security protocols are in place to prevent illegal ballots from being counted, including signature verification. However, in Washington, voters can bypass this verification through two witness signatures, which are not examined. Otherwise, it only takes a 20-30 percent confidence level for a signature to pass. Additionally, the OmniBallot service provides a signature curing and update feature, potentially offering another path for fraudulent activity.
Residency Requirements and Ballot Creation
Recent changes, such as the removal of a 30-day residency requirement, mean that any Washington state voter can create a ballot using the portal, regardless of their actual residential address. This loophole allows individuals to claim residence in King County and obtain a ballot, regardless of their true domicile.
Address Suggestion Feature
The OmniBallot portal further complicates the issue by suggesting addresses upon entering just a house number. This feature could be exploited to target specific districts, thereby influencing local elections with relative ease. The accessibility of this tool magnifies the potential for misuse.
Underlying Issues
The revelations surrounding the OmniBallot portal underscore two primary concerns: the laxity of Washington state election laws and the insufficient safeguards within the online voting system available through the OmniBallot portal. Whether these vulnerabilities stem from deliberate choices or inadvertent oversights in the system’s design remains unclear. However, the implications for election security are significant, demanding urgent attention and reform to protect the integrity of our electoral process and build trust among voters.
Excessive Accessibility
We investigated other OmniBallot portals for other counties and were not able to replicate this issue. There appears to be an issue with this specific King County portal.
Portals in Bexar County, TX, Spokane County, WA, West Virginia, and San Bernardino, CA do not offer the address search feature, which appears to be the feature that allows for ballots to be made for any address. Yolo County also does not offer the address search option, plus it includes a disclaimer that necessitates users’ agreement to their eligibility to use the system and get a ballot. The portal in North Carolina requires voters to send a request for a ballot and requires either a driver’s license number or a social security number for verification. Furthermore, Alabama’s portal issues a PIN to voters via email, which is essential for proceeding with ballot generation.
King County’s portal is the only OmniBallot portal that allows users to create ballots for anyone, at any address, without any verification of identity, eligibility, or even make an attempt confirm if the information belongs to a real person.
There is no reason that creating ballots needs to be this quick and easy. King County should ask Democracy Live to fix their OmniBallot portal to reduce the risk of fraud and manipulation.
