Mail-in voting fraud is nearly impossible to commit

Millions of Americans have voted by mail securely for more than 150 years, with fraud historically being so rare that election officials wouldn't even consider it significant enough to be a rounding error. But with the coronavirus pandemic pushing a record number of absentee ballot requests, President Donald Trump and his administration have attacked the time-tested system, claiming that it would lead to a chaotic Election Day outcome.

Since April, Trump has questioned the legitimacy of vote-by-mail on Twitter, saying it will "lead to massive corruption and fraud," without offering any evidence of what security flaws are present. Attorney General William Barr also claimed, in June, that voting by mail "opens the floodgates to fraud," also without any proof. 

Trump reasserted the claim in a false declaration of victory on Election Day, suggesting that millions of mail-in votes were fraudulent and shouldn't be counted after that point. The votes have already been cast, but states like Pennsylvania, Wisconsin and Michigan weren't able to start counting them until Election Day because of local election laws.

In a press briefing on election security on Aug. 26, senior FBI officials said they've found no evidence of coordinated fraud with mail-in ballots and also highlighted how unlikely the scenario would be.  

"It would be extraordinarily difficult to change a federal election outcome through this type of fraud alone, given the range of processes that would need to be affected or compromised by an adversary at the local level," the FBI said.

These attacks on mail-in voting aren't new, but they do come at a time when a record number of people in the US are expected to request absentee ballots because of the coronavirus pandemic. COVID-19 has killed more than 160,000 Americans, causing businesses to shut down to prevent the spread of the infectious disease; pushing people to keep their distance from each other; and leading children to attend school online or have their parties via webcam. Sending in your ballot is the next logical step when trying to stay safe.

In Minnesota alone, the number of requests for mail-in ballots has risen more than 16 times, to roughly 470,000, according to Steve Simon, Minnesota's secretary of state, who doesn't buy into the concerns raised by the president.  

"It would be almost impossible to pull off voter fraud on a scale that would be required to tip the balance," Simon said. "We have vanishingly rare cases of voter misconduct. The security precautions in place have stood the test of time."

The real danger is that these attacks damage the credibility of our entire democratic system. Election security officials have long warned that disinformation about voting is more concerning than the potential for someone to tamper with ballots. If you can get people to believe that results aren't legitimate, it doesn't matter whether fraud actually happened.   

"Nobody really has to successfully attack an election and demonstrate that votes were changed or ballots disappeared," said Mike Hamilton, a founder of CI Security and a former chief information security officer for Seattle. "You just have to raise enough doubt in people's minds."

The US Postal Service says it remains committed to delivering election mail on time, and it has been coordinating with local election officials, despite the many cuts to its services by the Trump administration.  

The truth is, fraud associated with mail-in ballots is exceedingly rare, and when it does happen, it's minuscule enough that it wouldn't affect the outcome, election officials and experts said, noting there are safeguards in place.

That truth gets distorted thanks to social networks. A Wall Street Journal report found over 100 claims from Trump, via Twitter, attacking mail-in voting, a majority of which are factually inaccurate.

The attacks on mail-in ballots, particularly when a pandemic threatens the health of voters and election volunteers, have frustrated experts, who point out that many of the scenarios raised by the Trump administration would be impossible to carry out. 

"When people throw these ideas around, it shows a lack of understanding of the overall process," said Amber McReynolds, CEO of the National Vote at Home Institute and Coalition, and the former director of elections for Denver.

How to get away with vote-by-mail fraud

Trump has repeatedly made claims -- which have been disputed by election officials -- that voter fraud could happen through foreign countries printing fake ballots and rigging the election.

Across the board, election security experts have pointed out just how difficult it would be to carry out election fraud on a scale large enough to actually affect the outcome. Printing a fake ballot would fall into the "nearly impossible" category. 

"The statement that other governments can print ballots and mail them to everybody is bullshit," Hamilton said. He pointed out that each ballot has a specific barcode generated and matched to the voter, with scanners being able to tell which votes are legitimate. "To print fake ballots with a matching barcode is not even possible." 

But in case you're curious, here's what you'd need to do to actually carry out voter fraud by mail and affect the outcome of an election. 

• Figure out every registered voter who requested a mail-in ballot

Not everyone's going to have a ballot automatically sent to their mailbox. For starters, you need to be registered to vote to receive one, and in some states, you need to have requested an absentee ballot to get it. 

Election officials aren't going to count votes for people who aren't registered voters, so any nation-state looking to print fake ballots would have to make sure they're for people who actually exist.

Absentee ballot requests are confidential in states like North Carolina, so depending on where you are, you'd have to get access to an election county's voter registration records illegally. That's not impossible: In 2016, Russian hackers stole data from two Florida counties' voter registration databases, but the next steps make committing fraud even more difficult.

• Intercept the ballot 

Now that you know who you're looking to defraud, you have to actually get their ballot to vote in their name. 

You can intercept the ballots by either racing to every mailbox and snatching the envelope out before the voters receive them while hoping they don't notice it's gone, or changing the voters' address so that they all send to your inbox instead. 

"You have to get into the voter registration system, get their address changed and go undetected doing that," Vote at Home's McReynolds said. "If you're in a state that offers ballot tracking, you have to avoid voters getting a text saying 'your ballot is on its way to you' or seeing that it went to the wrong address. You have to assume they're not going to vote or pay attention in a presidential year where we're going to have the highest turnout on record."

Counties across the US use ballot tracking, including Virginia, Florida, Kansas, South Carolina, Michigan and Illinois. BallotScout, an app from the organization Democracy Works, offers online tracking services for ballots where voters can see the status of their ballot the same way you'd track a package shipping. 

Ballot envelopes have specific barcodes on them that let the US Postal Service know that the package is a vote, with unique serial numbers on them tied to individual voter records. If you're trying to intercept a ballot, you'll need to overcome this tracking system too. 

"A voter would be able to see their ballot move through the mail stream, and they can advocate for themselves now," said Jessenia Eliza, Democracy Works' director of government initiatives. "They can say they sent this ballot five days ago, it should've been received, and call the office themselves."

• Get good at forging signatures and really good at guessing 

Nearly every state requires a signature on the ballot to verify a voter's identity when it's mailed in. The signatures need to match the ones logged on the voter's registration file, and is required for both issuing ballots and counting the vote. 

"Forging someone else's signature on an application and submitting it to receive a ballot is both extremely difficult, and a crime," Michigan's Department of State said in a statement. "It is rarely attempted."

Some states require multiple signatures, like a notary or a witness to sign off on the mail-in ballot. In North Carolina, voters have to sign their ballots in front of a witness, who also signs the envelope the vote is sent in. 

When you register to vote in Minnesota, Simon said, you also have to provide your driver's license number, your state ID number and the last four digits of your Social Security number. The state uses that to verify votes also. 

So once you intercept the ballot, you'd need to be able to account for all of these details too. 

"Unless the mailbox thief knows not only the person's personal identifying information, or which specific form they used, the joke is on the would-be thief," Simon said. 

Assuming you try your luck at forging signatures, some counties also have machines scanning for accuracy on the votes to make sure they match up. If it's not a good enough match, it often gets flagged to a person to check, and if enough anomalies pop up, election officials said they would investigate further. 

If you've gotten through all of these security checks, congratulations: You've done something most election officials would consider nearly impossible. 

But remember, you need to do this for hundreds -- if not thousands -- of people for your effort to actually affect the outcome.

Laying the groundwork for disinformation

A much easier way of disrupting the process is to cast doubt on the legitimacy of the election's outcome. 

Lawmakers are criticizing the Trump administration's decision to replace the Postal Service's two top executives, calling it a veiled attempt to sabotage the mail system and disrupt the mail-in voting process. Trump is also opposing funding to the USPS that would help it handle all of the mail-in ballots. 

"They want $25 billion -- billion -- for the post office. Now they need that money in order to have the post office work so it can take all of these millions and millions of ballots," Trump said in an interview with Fox Business on Aug. 13. 

Any delays in receiving mail-in ballots could contribute to Election Day uncertainty. Stacking the deck against USPS makes it much easier to cast doubt and disinformation about the election's outcome. 

The USPS also had a warning for the public.

"In order to allow sufficient time for voters to receive, complete and return ballots via the mail, and to facilitate timely receipt of completed ballots by election officials, the Postal Service strongly recommends that jurisdictions immediately communicate and advise voters to request ballots at the earliest point allowable but no later than 15 days prior to the election date," a USPS spokeswoman said in a statement. 

Because a lot of votes came in by mail, delays are a reality in tallying the ballots. Many states have deadlines to vote by mail right up until the polls close, making it unlikely to get the results on Election Day. 

New York City's primaries took weeks to tally up its mail-in votes, and experts were concerned about the same for the general election in November. People are used to knowing who won the election that same evening. The longer the delay, the greater chance there is for disinformation and distrust to flow on social media.

"Mail ballots certainly do take more time to process," McReynolds said. "We need to have a national conversation on what voting results look like." 

At a press briefing from the National Association of Secretaries of States on Oct. 13, just three weeks before Election Day, election officials in Michigan and New Jersey estimated that it would take at least three days to finish counting all the votes that have come in. 

Digital doubt

Disruptions can also come digitally -- election officials are frequently on alert for cyberattacks, working with government agencies like the Cybersecurity and Infrastructure Security Agency to test for vulnerabilities. 

There's no evidence that hackers have ever changed votes in an election, but a cyberattack could still cause concerns for officials. Counties that use computers to verify signatures, for example, could be affected if those devices are vulnerable. 

"A ransomware attack could affect the outcome of an election if it happens during the counting process," CI Security's Hamilton said. "If I can encrypt your data, I have enough access to change it. How are we going to prove it wasn't changed? It's the integrity of the votes -- that's exactly where this applies." 

Watch this: CISA director: Paper record key to keeping 2020 election secure

05:22

Simon, the secretary of state of Minnesota, said that while a cyberattack could cause disruptions, paper ballots and human intervention would prevent it from becoming catastrophic. People could still count the votes by hand, and even if the voter registration database was deleted, Minnesota has same-day voter registration policies. 

"Let's say a malicious hacker deletes a bunch of voter records so that an eligible voter stops in and they tell her she's not on the list," Simon said. "The remedy there would be some sighs and then a re-registration. We have figured out ways to foil or at least delay the impact of those kinds of things." 

Election officials can have security measures in place to prevent mail-in voter fraud and cyberattacks, but managing disinformation is going to be a much more difficult challenge. 

Twitter and Facebook have both labeled Trump's posts on mail-in voting as misleading information, but that hasn't stopped the spread of disinformation. 

A ProPublica investigation in July found that nearly half of all top posts on Facebook about voting by mail were misleading, presenting a concern more threatening than voter fraud for election officials. 

"You have to retain public confidence in these systems," Simon said. "My worry is that there's been criticism bordering on trash-talking."  

Secretaries of states agreed that Trump's remarks about mail-in voting could affect confidence in the election's integrity, but don't see it having a major impact. Even as Trump floats the idea of mail-in voting fraud on Twitter with three weeks leading up to the election, millions of voters in several states have already sent in their ballots, Michigan Secretary of State Jocelyn Benson said. 

And despite Trump's claims on social media, state officials said they also haven't seen any evidence of widespread voter fraud.

"The concerns that he's raised as it relates to absentee voting are not valid in Ohio," Secretary of State Frank LaRose said. "It's not helpful when any elected officials raise concerns about election administration and doesn't provide any evidence about those concerns."