The US National Academies of Sciences, Engineering and Medicine (NASEM) uses a comprehensive study process http://www.nationalacademies.org/studyprocess/ to ensure high standards of scientific and technical quality.
On September 6, 2018 they released their 2018 consensus report
Securing the Vote: Protecting American Democracy
The report is available to download as a PDF (login isn’t required, you can download as a guest) and is also posted to read online. (See blog note 1 for the definition of a consensus report.)
The key conclusions highlighted in the introduction to the release are:
All U.S. Elections Should Use Paper Ballots by 2020 …; Internet Voting Should Not Be Used at This Time
Emphasis (bolding) above mine.
Ensuring the Integrity of Elections
Chapter 5: Ensuring the Integrity of Elections contains many sections relevant to voting technology. Below are selected extracts only; please read the entire chapter for the full details.
Malware (pp. 86-87)
Malware can be introduced at any point in the electronic path of a vote—from the software behind the vote-casting interface to the software tabulating votes—to prevent a voter’s vote from being recorded as intended.
Maintaining Voter Anonymity (pp. 87-88)
With remote voting—voting outside of publicly monitored poll sites—it may not be difficult to compromise voter privacy. When voting, for example, by mail, fax, or via the Internet, individuals can be coerced or paid to vote for particular candidates outside the oversight of election administrators.
Election Cybersecurity
Election Cybersecurity (pp. 88-93)
Vulnerabilities arise because of the complexity of modern information technology (IT) systems and human fallibility in making judgments about what actions are safe or unsafe from a cybersecurity perspective. Moreover, cybersecurity is a never-ending challenge. It is unlikely that permanent protections against cyber threats will be developed in the near future given that cybersecurity threats evolve and that adversaries continually adopt new techniques to compromise systems or overcome defenses.
Election Cybersecurity: Cybersecurity and Vote Tabulation (p. 91)
Because there is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats, one must adopt methods that can assure the accuracy of the election outcome without relying on the hardware and software used to conduct the election. Uniform adoption of auditing best practices does not prevent tampering with the results collected and tabulated by computers. It can allow such tampering to be detected and often corrected.
I would clarify that it can only allow such tampering to be detected if there are paper ballots to audit.
Election Cybersecurity: Factors that Exacerbate Cybersecurity Concerns (p. 92)
Changing threat. Traditionally, the goal has been to secure against election fraud by corrupt candidates or their supporters who may attempt to favor a particular candidate by altering or destroying votes or tampering with the vote tally. The 2016 election vividly illustrated that hostile state actors can also pose a threat. These actors often possess more sophisticated capabilities and can apply greater resources to the conduct of such operations. Moreover, they may have other goals than shifting the outcome for a particular candidate.
Specifically they may be seeking to undermine confidence in the election process and systems, which is a different kind of attack than changing an outcome. Any kind of visible or detectable interference such as defacing websites, Distributed Denial of Service (DDoS), or disclosure of information from within voting systems may achieve the goal of undermining confidence.
Election Cybersecurity: [Consensus] Findings (p. 92-93)
There is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats.
…
In comparison with other sectors (e.g., banking), the election sector is not following best security practices with regard to cybersecurity.
…
Even if best practices are applied, systems will not be completely secure.
Foreign state–sponsored attacks present a challenge for even the most responsible and well-resourced jurisdictions. Small, under-resourced jurisdictions are at serious risk.
…
Better cybersecurity is not a substitute for effective auditing.
I will highlight just one item from the review of End-to-end-verifiability, and I want to make it clear it is a conclusion about voting technology, not about end-to-end verifiability
Complicated and technology-dependent voting systems increase the risk of (and opportunity for) malicious manipulation.
Internet Voting
Internet Voting is covered on pages 101 to 106, including specific examination of Blockchains from pages 103 to 105. Below are selected extracts only; please read the entire section in the document for the full details.
Internet Voting (pp. 101-106)
Insecure Internet voting is possible now, but the risks currently associated with Internet voting are more significant than the benefits. Secure Internet voting will likely not be feasible in the near future.
Emphasis (bolding) above mine.
Internet Voting: Blockchains (pp. 103-105)
blockchain technology does little to solve the fundamental security issues of elections, and indeed, blockchains introduce additional security vulnerabilities. In particular, if malware on a voter’s device alters a vote before it ever reaches a blockchain, the immutability of the blockchain fails to provide the desired integrity, and the voter may never know of the alteration.
Internet Voting: [Consensus] Findings (p. 106)
The Internet is not currently a suitable medium for the transmission of marked ballots, as Internet-based voting systems in which votes are cast on remote computers or other electronic devices and submitted electronically cannot be made adequately secure today.
…
The use of blockchains in an election scenario would do little to address the major security requirements of voting, such as voter verifiability. … In the particular case of Internet voting, blockchain methods do not redress the security issues associated with Internet voting.
Internet Voting: Recommendations (p. 106)
5.11 At the present time, the Internet (or any network connected to the Internet) should not be used for the return of marked ballots.35,36 Further, Internet voting should not be used in the future until and unless very robust guarantees of security and verifiability are developed and in place…
35 Inclusive of transmission via email or fax or via phone lines.
36 The Internet is an acceptable medium for the transmission of unmarked ballots to voters so long as voter privacy is maintained and the integrity of the received ballot is protected.
[1] Note: The NASEM defines a consensus report as follows
Consensus Study Report: Consensus Study Reports published by the National Academies of Sciences, Engineering, and Medicine document the evidence-based consensus on the study’s statement of task by an authoring committee of experts. Reports typically include findings, conclusions, and recommendations based on information gathered by the committee and the committee’s deliberations. Each report has been subjected to a rigorous and independent peer-review process and it represents the position of the National Academies on the statement of task.
[2] The report may be cited as e.g.
National Academies of Sciences, Engineering, and Medicine. 2018. Securing the Vote: Protecting American Democracy. Washington, DC: The National Academies Press. doi:10.17226/25120
Paper Vote Canada 2 