TheWashington Post | October 4, 2010
By Mike DeBonis

Last week, the D.C. Board of Elections and Ethics opened a new Internet-based voting system for a weeklong test period, inviting computer experts from all corners to prod its vulnerabilities in the spirit of "give it your best shot." Well, the hackers gave it their best shot -- and midday Friday, the trial period was suspended, with the board citing "usability issues brought to our attention."

Here's one of those issues: After casting a vote, according to test observers, the Web site played "Hail to the Victors" -- the University of Michigan fight song.

"The integrity of the system had been violated," said Paul Stenbjorn, the board's chief technology officer.

Stenbjorn said a Michigan professor whom the board has been working with on the project had "unleashed his students" during the test period, and one succeeded in infiltrating the system. 

The fight song is a symptom of deeper vulnerabilities, says Jeremy Epstein, a computer scientist working with the Common Cause good-government nonprofit on online voting issues. "In order to do that, they had to be able to change anything they wanted on the Web site," Epstein said.

Because of the hack, Stenbjorn said Monday, a portion of the Internet voting pilot -- which was expected to be rolled out this month -- is being temporarily scrapped.

The program, called "digital vote by mail," is intended to allow military or overseas voters to cast secure absentee ballots without having to worry whether the mail would get them back to elections officials before final counting. Those voters, about 900 of them, still will be able to receive blank ballots via the Internet for the Nov. 2 general election, but they will not be allowed to submit their completed ballots via the DVM system, Stenbjorn says. Instead, they'll have to put them in the mail or send them unsecured via e-mail or fax.

The security hole that allowed the playing of the fight song has been identified, Stenbjorn said, but it raised deeper concerns about the system's vulnerabilities. "We've closed the hole they opened, but we want to put it though more robust testing," he said. "I don't want there to be any doubt. ... This is an abundance-of-caution sort of thing."

Last week, Common Cause and a group of computer scientists and election-law experts warned city officials that the Internet voting trial posed an unacceptable security risk that "imperils the overall accuracy of every election on the ballot." But board officials said the system provides security and privacy upgrades over a method of Internet voting that's already legal: filling out a paper ballot, then scanning it and attaching it to an e-mail.

Stenbjorn says he hopes that the Web-voting system's security vulnerabilities will be addressed in time for a D.C. Council special election expected next spring. The board has spent about $300,000 in federal grant money on the project.

A D.C. Council hearing on elections issues, which will include the Internet voting test, is set for Friday.