Electronic Ballot Return Background
Military and overseas voters, and other U.S. citizens covered by the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA), face significant challenges when attempting to cast their ballot. Recent figures from the U.S. Department of Defense Federal Voting Assistance Program (FVAP) indicate that since 2016, there is a 60-65 percentage point gap in voting participation between U.S. domestic and overseas voters, depending on the type of federal election (presidential or midterm) being administered. Approximately half of this gap can be attributed to obstacles preventing those who want to vote from doing so.
While electronic ballot return presents potential benefits and a unique opportunity to improve voting outcomes among UOCAVA voters, balance between critical security considerations and ballot access is necessary for success. This challenge is discussed in The Council of State Governments (CSG) Overseas Voting Initiative (OVI) 2021 paper, Electronic Ballot Return for Military and Overseas Voters: Considerations for Achieving Balance Between Security and Ballot Access.
In this digital age, many jurisdictions have considered the potential risks and benefits of electronic ballot return and have opted to allow for some method of electronic return for UOCAVA voters. Thirty-one states have authorized some form of electronic return for those voting outside the polling place.* *Only 22 of these states have allowed UOCAVA voters to return their ballot via electronic mail. To mitigate the security risks associated with emailing ballots, states and local election jurisdictions continually deploy measures to verify the integrity of a voted ballot and protect local networks from malware.
Two such risk mitigation measures are the application of sandboxing techniques and the use of .gov email domains by election officials. In the cybersecurity field, a sandbox is another term for an isolated environment on a network that allows the secure review of material potentially infected with malware without risking harm to the host device or network.
Electronic Ballot Return via Email in South Carolina
South Carolina is among the 22 states allowing email return of marked ballots. In 2015, the legislature adopted §7-15-690 allowing the South Carolina State Election Commission to, “take all steps and action as may be necessary” to ensure that citizens covered by UOCAVA have the opportunity to vote. This direction authorized the State Election Commission to allow for the electronic return of marked ballots by all UOCAVA voters.
In South Carolina, as in most states and local election jurisdictions, limited resources have made it difficult for local election officials to acquire and update cutting-edge digital tools that help protect against continually evolving cyber threats. Election officials facing both resource and time constraints often have resorted to using platforms such as Google Mail and Yahoo Mail to conduct election-related duties. These commercial platforms do not necessarily have heightened security protocols in place that allow emails containing ballots to be robustly screened for malware and subsequently quarantined.
Statewide Adoption of Sandboxing Techniques in South Carolina
By late 2018, in an effort to apply heightened security protocols across all local election offices in South Carolina while still being mindful of costs, former Executive Director for the South Carolina Election Commission Marci Andino and her team began collaborating with South Carolina’s State Data Center to set up secure email addresses to be used by all 46 county election offices. The resulting accounts were set up with .gov domains to help voters better identify local election officials and therefore, give the voters confidence in the election information provided.
The creation of these secure email accounts also posed unique security benefits for local election officials. Through the State Data Center, sandboxing techniques were integrated into the new accounts to provide officials with enhanced and continuous protection against malware. In essence, sandboxing provides account holders with a more secure environment where electronic ballot attachments can be opened securely to isolate potential viruses or other malware. This is done prior to an email entering the local network or mail server. If threatening activity is detected, the email is flagged and the account holder is prevented from unknowingly opening the malicious content, thereby infecting their network.
Beginning in January 2019, all counties in South Carolina were required to either adopt the state-issued email account or provide the State Election Commission with proof the county was using another secure system. Given the significant cost of instituting sandboxing techniques individually, most South Carolina local election offices opted to transition their communication with voters to the state supplied .gov accounts. Voter instructions and other supporting ballot materials were modified using these new email addresses.
Rollout Factors Leading to Success in South Carolina
According to Andino, the transition to .gov email addresses was initially met with reluctance from some local officials. That quickly passed when officials understood how easy and cost-effective these changes would be and how much this process would enhance the security of the electronic ballot delivery process. “Resistance to change is natural and rarely is there a perfect time to implement technology changes. Our job at the South Carolina Election Commission was to explain the value of the new technology and make the transition as easy as possible for the local election officials and their voters.” said Andino. “We did just that.”
In South Carolina, the State Election Commission plays an integral role in the conduct of elections at the local level. All local jurisdictions receive the technology infrastructure necessary to conduct an election from the State Election Commission. This structure has facilitated the adoption of secure .gov email accounts throughout the state. Uniform voter registration databases, voting systems and corresponding administrative procedures also have helped minimize the number and type of issues encountered at the local level. Furthermore, the authority of the State Election Commission has helped ensure all South Carolina local election offices, not just a select few, are using secure email accounts.
As of early 2022, the .gov email accounts have been used throughout South Carolina in hundreds of elections without issue. Through leveraging the State Data Center to create these accounts, local election officials in South Carolina have gained access to effective threat detection and mitigation safeguards that would otherwise be too costly for local jurisdictions to implement and troubleshoot.
When authorized by state statute, email remains the most popular electronic ballot return method used by UOCAVA voters. As technology evolves, the cyber threats to the email transmission of ballots increase. Enhanced security measures and risk mitigation strategies are warranted to ensure the secrecy and integrity of a voter’s ballot is preserved. CSG’s work with South Carolina and other states utilizing sandboxing techniques has uniquely positioned OVI to support states as they seek to implement similar solutions. Please reach out if OVI can assist in connecting your office with other states and local election offices who have successfully transitioned to secure email and sandboxing.
*Special acknowledgement to CSG OVI Working Group member and former Director of the South Carolina Election Commission, Marci Andino, for working with the OVI team on this piece, as well as to CSG team member, Rachel Wright.
**For the purposes of this article, forms of electronic ballot return include email, fax, and secure web portal.