I just read Doug Chapin’s article on the vote rigging at Cal State San Marcos, and I would add several observations. Had this been a public election conducted via Internet voting, it would have been much more difficult to identify any problem or to capture the perpetrator, Matthew Weaver. Mr. Weaver was captured because he was voting from school-owned computers. This was networked voting but not really Internet voting. The IT staff was able to notice “unusual activity” on those computers, and via remote access they were able to “watch the user cast vote after vote”. But in a public online election people would vote from their own private PCs, and through the Internet, not on a network controlled by the IT staff of election officials. There will likely be no “unusual activity” to notice in real time, and no possibility of “remote access” to allow them to monitor activity on a voter’s computer. Note also that university IT staff were able to monitor him while he was voting, showing that they were able to completely violate voting privacy, something we cannot tolerate in a public election.
In the Cal State San Marcos election votes apparently had to be cast from computers on the university’s own network, and not from just anywhere on the Internet. I infer this because it makes good security sense, and because I cannot think of any other reason Mr. Weaver would cast his phony votes from a university computer rather than from an anonymous place like a public library. If this is correct, it is a huge security advantage not possible in public elections, where the perpetrator could be anywhere in the world. Even if public officials somehow did notice an unusual voting pattern that made them suspicious after the fact that phony votes were cast, there would be no evidence to indicate who it was, and no police on the spot to pick him up red handed.
Even with the restriction to voting on university-managed computers Mr. Weaver could still have gotten away with his crime, but he made several mistakes. He cast hundreds of phony votes one by one, in person, while sitting at the keyboard of the computer. But if he had been a programmer and been a little smarter he would have used one of his captured passwords to log in as someone else, and then (as that person) he could have run a program to automate the casting of all of those phony votes, possibly even from other machines. He could have scheduled the script to run an hour later when he was long gone, and with a random delay between each cast vote so that detection of a suspicious pattern would be less likely. The scheme might still have been caught anyway, but there would have been no technical evidence implicating Mr. Weaver.
When he was arrested Mr. Weaver was caught with very suspicious hardware keylogging devices on his person that he had used to capture people’s passwords. Again, if he had been a little smarter, he would have used one of his keylogging devices to capture the password of a system administrator, and then used that password to install keylogger software on other campus computers to capture the students’ passwords. Then he would not have had any hardware keyloggers on him and would not have been tied to the crime that way. Or if he had been able to capture a root password he might have been able to use it to simply edit the database of recorded votes, and not bothered with actually casting any phony votes.
Finally, we have to note that even though Mr. Weaver was caught, there was apparently no way to know for certain (other than taking his word for it) exactly which votes were the phony ones he cast. They could not simply remove his votes from the count and let the election be certified based on the remaining votes. They had to cancel and re-run the entire election. Needless to say, this would not be an easy option in a public election, which can only be cancelled after the fact by a court after lawsuits and potential appeals. The legal process in such a case would likely be a protracted mess and permanently damage public confidence in elections (again).
In the many debates on the subject of Internet voting it is important not to allow anyone to use this Cal State San Marcos student election experience to argue that online public elections can be made safe because those who would cast phony votes will be caught. Mr. Weaver’s actions were detected because he was voting from computers controlled by the university IT staff, and he was identified and caught because he was not even minimally technically skilled in the techniques that could have distanced him from the crime. In a high stakes public election we will not be so lucky.
This article was originally posted on July 17 2013 on the Election Law Blog.