Arson, water damage: Paper ballots are fragile. But there's a reason we don't vote online

Only a small group of voters is allowed to cast their vote online. There are good reasons why.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
Laura Hautala
5 min read

Returning a physical copy of your ballot is the safe option, cybersecurity experts say. The fewer people who return their ballots online, the less tempting of a target it becomes for hackers.

James Martin/CNET

Fire and flood have threatened paper ballots in this election, with a fire set inside a ballot drop box in Los Angeles County, California, and a broken water pipe dousing a room where ballots were stored in Fulton County, Georgia. The Georgia ballots weren't harmed, according to the Atlanta Journal-Constitution, but some of the California ballots were damaged. Still, election security experts say paper ballots are the safest and most secure way to vote.

That's why, despite the high demand for absentee voting this year, the vast majority of people aren't allowed to vote online. Internet-enabled voting is limited to thousands of overseas, military, sick and disabled voters. Each election cycle, some will mail back printouts of their marked, signed ballots, which is the most secure option. Others will return the ballots via email, fax or web portal.

There's a great big caveat for voters in the second group. They must generally waive their right to a secret ballot. That's because your name is attached to your ballot as it travels to your election agency. Additionally, cybersecurity experts say there's no technology today that can secure online voting. While fraud is part of the cost of doing business with industries like banking, which millions of people access over the internet, fraud isn't an acceptable risk for elections agencies and can't be easily fixed after the fact. To secure online elections, we'd need technology that can stop ballot tampering from happening and detect compromised ballots before they're counted. We're not there yet.

Read moreElections misinformation: How to separate fact from fiction

Waiving your right to a secret ballot is a big decision. Ever since the US embraced the secret ballot in the late 1800s, voters have viewed it as essential to protecting their choices from external pressure. And running the risk that hackers will tamper with your ballot is a scary prospect that has an impact beyond just your vote. 

Still, some uses of the internet are riskier than others when it comes to ballots. Here's everything you need to know about using the internet to vote, and what makes sense for you.

Election voter information guide

Only a small number of people vote online.

James Martin/CNET

Why some people get their ballot online

There are two reasons it might make sense for you to ask your local election agency, typically a county clerk, to send you a blank ballot over the internet. If you're out of the country, getting a PDF of a blank ballot cuts out one end of the mail system. That's why federal law requires states to provide ballots electronically to military and overseas voters.

Or, you might have a disability that makes it hard for you to fill out a paper absentee ballot. This includes people with low vision or limited mobility. In that case, getting a PDF lets you mark your ballot on your computer without needing help from a friend or family member. Many states offer this option, including Pennsylvania, Louisiana, Utah, Delaware and West Virginia. You can contact your county clerk or secretary of state to learn what's available to you.

Read more: Voted by mail? Here's how to track your ballot online

This is where security experts will step in and say, it's fine to receive your ballot online. The election agency will either email or fax you a PDF of the ballot, or it might give you a link to a web portal where you can download it. As with paper absentee ballots, these electronic versions come with bar codes and other fraud detection measures. As with any form of voting, you can access a sample ballot from your county and compare it to your blank ballot to reassure yourself everything is correct.

Is it safe to mark a ballot online?

If your election agency lets you mark your ballot on the web portal, that's probably safe too, although it can come with risks. Security researchers from MIT and the University of Michigan found that the Democracy Live web portal, called OmniBallot, sometimes sends data about voters' ballot choices back to the company's servers. 

Democracy Live says it doesn't store or access this data, but the researchers say it's an unnecessary risk. If hackers compromised the company's systems, ballots would be vulnerable. States can choose a version of OmniBallot that keeps data about ballot choices on your computer, a more secure option. However, not every state does this. If you're concerned about this risk, you can ask your local election agency how its system for marking ballots electronically works.

Another ballot portal, from Voting Works, also lets voters mark their ballots in a web browser. It always keeps ballot choices on voters' machines, the company says. 

The big risks of returning ballots electronically

Many states allow some combination of military, overseas and disabled voters to return a ballot electronically. Depending on the state or county, voters might be able to return the ballot over a web portal, or they might be asked to email or fax an image of the ballot. Voters who use fax or email typically print and sign their marked ballots before scanning or photographing it to send it back. 

Voters who go this route must generally waive their right to a secure ballot, and cybersecurity experts say these options aren't secure, period. 

Hackers could infiltrate your computer using malware or compromised websites and change your votes. There's no documented cases of this happening, but there's also no good fraud prevention to detect it. They also have a variety of tools to access faxes and email systems. Finally, hackers could try to compromise the systems of companies such as Democracy Live and steal or alter ballots there.

We're at least 10 years away from having technology that could let voters cast ballots online securely, said Dan Wallach, a computer science professor at Rice University who consults for Voting Works. That includes technology that would keep hackers off your computer, where they could tamper with your vote, as well as systems for stopping voting fraud before it happens.

For now, Wallach said, "We still like the idea of a piece of dead tree going through the mail." 

What cybersecurity experts say

Mailing a physical copy of your ballot back to your election agency is the safest choice for absentee voting. You can typically do this after getting your blank ballot electronically. Usually, voters must sign the printout before putting it in the mail, and it's important to make sure you have enough postage.

Still, some people will be tempted to use an electronic method to avoid mailing their ballot internationally. If the country you live in has unreliable mail, that might be a major concern. And this year, slowdowns in the US mail system may compound the problem.

It's best if only a small percentage of US voters take this route, cybersecurity experts say. The more voters who use it, the more motivated hackers will become to find ways to compromise ballots sent online.