Dustin Brewster

Researchers at MIT have found an internet voting app being used by West Virginia has vulnerabilities that could allow hackers to change a person's vote without detection.  (AP file photo/Melinda Deslatte)

CHARLESTON — An internet voting app that has been used in pilot elections in West Virginia, Denver, Oregon and Utah has vulnerabilities that could allow hackers to change a person’s vote without detection, according to researchers at the Massachusetts Institute of Technology.

The analysis of the Voatz app, which has mostly been used for absentee voters and overseas military personnel, found that attackers could “alter, stop or expose how an individual has voted.”

Voting security experts have long argued that online voting is dangerously insecure.

“We all have an interest in increasing access to the ballot, but in order to maintain trust in our elections system, we must assure that voting systems meet the high technical and operation security standards before they are put in the field,” Daniel Weitzner, an MIT scientist who oversaw the report, said Thursday.

The researchers said they were forced to reverse engineer an Android version of the app because Voatz hasn’t allowed transparent third-party testing of the system.

Boston-based Voatz disputed the research methods, issuing a statement that said the analysts used an old version of the app and accused them of acting in “bad faith.” The company noted it hasn’t had any reported issues in its counting of less than 600 votes over nine pilot elections.

Although few voters are expected to cast ballots on such apps in the coming election, the report casts a harsh light on the looming proposition of online voting. In 2018, Alaska explored using an online voting system but shuttered the program because of security concerns.

To some experts, a study finding holes in a smartphone voting app wasn’t a shock.

“Not to in any way diminish this (excellent) work, but the fact that an online mobile voting scheme has serious security flaws is ultimately unsurprising,” tweeted Matt Blaze, a professor of computer science and law at Georgetown University. “Every serious expert has warned against Internet voting.”

Voatz was used in West Virginia’s 2018 elections, but state officials were quick to point out that it counted fewer than 200 ballots and had no reported problems. The app also was used in the 2016 Massachusetts Democratic Convention and the 2016 Utah Republican Convention.

The study comes as West Virginia prepares to choose an online voting system for a newly passed law requiring that it allow people with physical disabilities to vote electronically. Donald Kersey, a general counsel in the Secretary of State’s Office, said officials haven’t decided on which platform they will use to conform to the new law but maintained that public confidence is paramount.

“Obviously, integrity and security are prime, but voter confidence is equally important,” he said.

During a Senate Judiciary Committee meeting in January, Kersey testified counties would not be required to use the app, but it was the only option provided to them by the state. He said it may be possible to use a program developed by the state of Maryland.

The Voatz app is provided to the state for free thanks to a donor.

Herald-Dispatch reporter Taylor Stuck contributed to this report.

Welcome to the discussion.

Keep it Clean. Please avoid obscene, vulgar, lewd, racist or sexually-oriented language.
Don't Threaten. Threats of harming another person will not be tolerated.
Be Truthful. Don't knowingly lie about anyone or anything.
Be Nice. No racism, sexism or any sort of -ism that is degrading to another person.
Be Proactive. Use the 'Report' link on each comment to let us know of abusive posts.
Share with Us. We'd love to hear eyewitness accounts, the history behind an article.