Vulnerabilities of Maryland's Online Registration System Put Voters at Risk

SAVE our Votes (SOV) recommends that Maryland voters check their voter registration information to make sure that no one has tampered with it, following revelations that hackers could easily gain access to Maryland’s new online registration system. 

According to several nationally prominent computer security experts who recently wrote a letter to Maryland’s State Board of Elections (SBE), the new online voter registration system has “severe security vulnerabilities” that “leave the system open to large-scale, automated fraud, and make the Maryland system among the most vulnerable of all states’ new online voter registration systems.” Voters could have difficulty voting on election day if their registration information was altered in certain ways.

SOV first alerted the State Board of Elections about the problem in August and then worked with computer security experts and election advocates from other states to develop recommendations to prevent, detect, and recover from potential attacks. The computer experts wrote a letter to the SBE in late September suggesting specific remedies election officials could put in place, both immediately and after the election. The SBE has never formally acknowledged receipt of nor responded to the letter, though it was discussed at the agency’s September 27 meeting.

According to an article published last Friday in the New York Times, the SBE says it has checks in place to detect fraud. But the SBE does not acknowledge that legitimate transactions may be nearly impossible to distinguish from fraudulent ones, and that if problems are discovered in the polling place, procedures for resolving them must be outlined in advance. 

SOV has held off from publicizing this vulnerability until after the close of Maryland’s voter registration on October 16. Now the group urges voters to check their registration records online. Any registration changes not authorized by the voter, especially changes of address, should be reported immediately to the ACLU of Maryland's Election Protection Hotline at 1-888-496-2258, which will help voters work with election officials to ensure that problems are resolved.

SOV also urges election officials to put in place the following safeguards:

1)    For all address changes submitted online, send voter notification cards to both the old and new addresses. Currently notification cards are sent only to the new address, so a voter might not know that his or her address has been fraudulently changed.

2)    If a fraudulent address change causes a voter to vote by provisional ballot, use the “Other” reason code to flag the problem. During canvassing, count the entire ballot as if it was cast in the correct precinct.

3)    Take the system offline now that the registration deadline has passed until improvements can be made to better secure it against tampering.

We sincerely hope that no one has taken advantage of this vulnerability to gain political advantage. But unfortunately Maryland has a history of deceptive leaflets, fraudulent robocalls, and other election malfeasance, so it is surprising that the SBE is not taking this threat more seriously.