Computer security experts have warned that the 2013 Oscars ballot may be vulnerable to a variety of cyber attacks that could falsify the outcome but remain undetected, if the Academy of Motion Picture Arts and Sciences follows through on its decision to switch to internet voting for its members.
The Academy announced last week that it would be ditching its current vote-by-mail system and allowing its members to fill out electronic ballots from their home or office computers to make their choices for best picture and the other big Hollywood prizes, starting in 2013.
It announced a partnership with Everyone Counts, a California-based company which has developed software for internet elections from Australia to Florida, and which boasted it would incorporate "multiple layers of security" and "military-grade encryption techniques" to maintain its reputation for scrupulous honesty in respecting its members' voting preferences.
The ballot change will be a culture shock for an Academy voting community that tends to be older and more conservative: indeed, concerns are already surfacing as to whether all of the Academy voters even have email addresses.
But Everyone Counts' security claims have been met with deep scepticism by a computer scientist community which has grappled for years with the problem of making online elections fully verifiable while maintaining ballot secrecy – in other words, being rigorous about auditing the voting process, but still making sure nobody knows who voted for what. So far, nobody has demonstrated that such a thing is possible.
"Everybody would like there to be secure internet voting, but some very smart people have looked at the problem and can't figure out how to do it," said David Dill, a professor of computer science at Stanford University and founder of the election transparency group Verified Voting. "The problem arises as soon as you decouple the voter from the recorded vote. If someone casts a ballot for best actor A and the vote is recorded for best actor B, the voter has no way of knowing the ballot has been altered, and the auditor won't be able to see it either."
Dill and many other leading computer scientists have listed multiple potential vulnerabilities to internet systems making vote-tampering possible, including denial-of-service attacks, malware, and penetration of the server's security wall. He reacted with particular alarm to the notion that the Academy's more than 5,000 voters would cast their ballots from their own computers.
"The hardest problem is when you have malicious software on the machine where the vote is cast," he said. "If that's the user's home PC, that's a huge problem, because lots of people have undetected viruses on their machine. A lot of people are under the control of hackers in eastern Europe, or wherever, and don't even know it."
Three years ago – in the wake of a decision by the Democratic party to let overseas voters participate in its presidential primary via internet – Dill issued a formal statement outlining the problems with internet voting, and persuaded 30 of America's top computer scientists to sign it.
Separately, a group of largely European computer and election experts signed a very similar statement known as the Dagstuhl Accord, which welcomed further research on internet voting but concluded that "no solution … has yet been proposed that provides safeguards adequate against various known threats".
Peter Ryan, a British professor of Applied Security at the University of Luxembourg who helped convene the Dagstuhl meeting in western Germany and has tried for years to design a safe computer voting system, said he was unimpressed by what he had seen of the Everyone Counts software. "It looks like what they are offering is little more than some fancy crypto on certain links," he said. "This of course achieves very little … I'm sure that someone with some expertise and motivation could break it."
Such deep – and relatively well publicised – reservations by the world's computer experts seemed to come as a surprise to the Academy itself. "I'm not personally aware of that particular dialogue," the Academy's chief operating officer, Ric Robertson, said when told of the near-total unanimity of computer experts.
Robertson said he and his colleagues had relied principally on the expertise of PriceWaterhouseCoopers, the accountancy firm which for many years has taken responsibility for Oscars ballot management and security. During an 18-month search for the right partner on computer voting, both the Academy and PwC had also sought "outside help", Robertson added. He would not elaborate.
The Academy is certainly not the first organisation to find internet voting appealing, nor is it taking the lead on the issue. Several US states have now adopted i-voting schemes to help military personnel and other US citizens stationed overseas get their votes in on time – for example, in this week's Republican primary in Florida.
Everyone Counts, and companies like it, have built their reputation by exuding greater professional competence and openness than the computer companies which introduced electronic touchscreen voting terminals to the US public in the wake of the highly contested 2000 presidential election. Many of those companies were later excoriated for producing lousy software under secretive conditions and failing to provide any meaningful auditing mechanism.
Lori Steele, the chief executive of Everyone Counts, argued passionately that the systems her company uses have, by contrast, passed muster with some of the toughest security clients in the world, including government defence and intelligence agencies. "This software is being used for the most mission-critical things in the world," she said. "To pretend it's not good enough for voting does a disservice to the voters … Not using the technology disenfranchises voters and hurts their human rights."
When pushed, however, Steele did not take issue with the computer scientists about the special problems relating to the secret ballot. Rather, she made the argument that no system is perfect and that computers are inherently more reliable than paper ballots. "Paper is more easily forged and hacked than any computer system," she said.
Many computer experts say that is wishful thinking. In 2004, the US Department of Defense canceled a pilot internet voting programme for overseas members of the military because of concerns about security. In 2006, the Netherlands abandoned plans to adopt internet voting in its elections because of problems that arose during testing.
In the UK, the local council in Swindon, Wiltshire, hired Everyone Counts in 2007 to conduct one of a series of pilot elections involving internet voting, among other new methods. According to a report conducted for the Electoral Commission, a deliberate attempt by security experts to penetrate the system on the eve of the vote exposed a number of serious flaws. Some were fixed at the last minute, causing a long delay in voting on election day, while others were deemed too risky to try to address in a hurry.
More serious problems still were exposed when overseas voters were invited to vote by internet in a local election in Washington, DC, in October 2010. A team led by Alex Halderman, a computer scientist at the University of Michigan, took control of the server software (not developed by Everyone Counts) and was able to change votes and find out who had voted for whom. The team even observed other hackers from Iran and China interfering with the election and took steps to thwart them.
Everyone Counts boasts on its website that it is willing to share its computer code with independent auditors and reviewers, but in practice that has proved difficult to achieve. David Dill of Verified Voting obtained a version of the code about 18 months ago but was so deterred by the legal limitations on what he could say that he never published his findings. Steele said separately that he was not authorised to discuss them with anybody except her company.
"Not letting me talk about it is not going to prove much to anybody else," Dill said. "The goal of complete openness ought to be to prove the security of their system, and to do that they need to do more than they have done … Without giving away any trade secrets, I think I can say that I was not persuaded it was secure at the level we need."
The Oscars might not hold the same significance as, say, a presidential primary or a governor's race, but the Academy still prides itself on a long tradition of absolute ballot security. Ric Robertson said his intention in introducing internet voting was certainly not to change that tradition. "The prime directive from our leadership was, we can't afford to have the vote leaked or the tabulation compromised in any way," he said.
The Academy, PwC and Everyone Counts intend to spend much of the next year conducting tests to try to fulfil that directive. Steele said the Oscars voting would remain entirely secret, but Robertson indicated that PwC might, in a pinch, reserve the right to check who voted for whom. (He then backtracked, saying he deferred to Steele's superior knowledge.)
Dill said his concern about the arrangement went well beyond the integrity of the Academy Awards themselves. Rather, he worried about the publicity implications of an awards ceremony broadcast to tens of millions of people across America and around the world.
"I don't want this to set a precedent and give a PR push to internet voting generally," he said. "I don't want the message to be: they used it for the Academy Awards, so it's OK to use it to vote for the president."
