Adventures in E-Voting Precede State Experiments

Although voting for Congress remains behind the times, the Academy Awards began experimenting with e-voting in 2013. Unfortunately, it didn't go very well. They set the security on it so high that many members couldn't figure out how to prove who they were and login. Then again, the median age of its 5765 members is 62.

Your average Oscars E-Voter doing the deed

Despite some older members predicting most people would give up and not vote, it actually turned out to be their highest voter turnout on record. The 2014 e-voting process went by without complaint, so they appear to have fixed the below issues.

The e-voting process involved a 6 step process:

1) Pay your dues, which ties your credit card and that verification system to you.

2) Receive a Voter ID number in the mail, which adds your address to the level of verification.

3) User your Voter ID to go online and setup a Voter Password, with numerous annoying requirements like caps, special characters, etc  You also enter your cellphone number.

4) When the voting period opens, login with your Member Password, then your Voter Password.

5) Once you enter the second password, you receive a text with a security code. You then type that in, and finally, can vote. This would be the final step, but it seems most members with trouble forgot their second password.

6) The reset password process was very badly designed. To get a reset you had to wait about 24hrs.

On step 3, it's long been shown complexity requirements tend not to make passwords more secure. Only long-length requirements like 12+ chars with no max length have been shown to significantly improve security of a password; complexity requirements usually encourage more patterned passwords, which make them easier to hack, and more passwords forgotten.

In step 3, they also complained that the password box is a standard password box, with asterisks hiding what you're typing. I have to say I agree. The idea that most people are passwording into things in someplace where someone could be looking over their shoulder, stealing their password is a poor assumption. Hiding passwords should be opt-in, not assumed, and if you want a long, complex password - you've gotta make it easy to see that long, complex gobbledygood you're typing in.

Step 2, where the voter is notified by paper mail of an electronic voting system seems to be an unnecessary inconvenience; if they were texted or emailed a link, they could skip this and potentially the second password, at least if you could reasonably believe/verify the person you were texting/emailing was the right person.

But, by involving their physical address, the Oscars' system provides some insight into what would be involved in e-voting in local and federal elections, since legally all that's required to prove you're you in US elections is your address. A ballot is sent to your home, or you provide your address at a polling place, good enough - we believe you. Given the low legal burden, this e-voting system - with some simplifications - could plausibly be used in US elections. Worth watching to see if they cope with any fraud or hacks.

http://www.npr.org/2013/01/03/168560518/e-vote-hiccups-delay-oscar-balloting

http://www.hollywoodreporter.com/race/oscars-e-voting-problems-worse-406417

http://www.huffingtonpost.com/2013/01/10/oscar-voting-concerns_n_2451160.html

http://www.hollywoodreporter.com/race/audience-heckling-disneys-legacy-a-669305