← All posts

They opened the internet-voting pilot to the public. It fell in 48 hours.

A university team broke into Washington D.C.'s internet voting pilot, changed every ballot, and made the server play a fight song — and officials didn't notice for days.

It is September 2010, and somewhere on a server in Washington, D.C., a University of Michigan fight song is playing.

Not because anyone scheduled it. Because a team of researchers just took over a live internet voting system — changed every ballot inside it, read every secret vote, and then, as a calling card, programmed the server to play "The Victors" after each simulated submission. They did it in roughly 48 hours. And for several days, nobody in the District of Columbia's Board of Elections noticed a thing.

That is where this story starts. Not with a conspiracy, not with a foreign adversary, not with a close race. With a university research team, a public invitation, and a vulnerability that fell in two days flat.

The pilot that almost wasn't a test

In 2010, D.C. was trying to do something genuinely progressive. Overseas and military voters faced real barriers returning their ballots in time. The city built an internet ballot-return system to fix that — and before deploying it for real elections, officials did something almost unheard of: they opened it to the public for adversarial testing.

They called it an open trial. They posted the server. They told the world: come find what's wrong.

A team led by J. Alex Halderman — Scott Wolchok, Eric Wustrow, Halderman, and Deepak Prasad — showed up. Within approximately 48 hours, they had exploited a software vulnerability and gained near-complete control of the pilot server. They could change ballots that had already been cast. They could read votes that were supposed to be secret. They demonstrated this by reprogramming the system to play the University of Michigan fight song after each vote. The intrusion went undetected by officials for days. The findings were later published as a peer-reviewed paper, "Attacking the Washington, D.C. Internet Voting System," at Financial Cryptography 2012.

D.C. dropped plans to use the system for live binding votes.

The vulnerabilities were caught precisely because the city opened the system to public attack before real ballots were at stake. Public adversarial testing turned a would-be disaster into a caught defect.

That is the whole lesson of this story — but it takes some unpacking to understand why it is so hard to act on.

What "certified" actually tests

Here is what strikes most people when they first encounter this case: wasn't the system reviewed before it was opened for public testing? Almost certainly, yes — in some form. Election systems routinely go through security reviews, vendor testing, and certification processes. And a team of graduate-level researchers still walked through the front door in 48 hours.

This is not a knock on the officials who built the D.C. system. It is a knock on the concept of closed-box certification as a substitute for open adversarial review.

The U.S. Government Accountability Office documented as far back as 2005 that federal efforts to improve electronic voting security and reliability were "under way but that key activities remained incomplete" — years after the Help America Vote Act mandated the creation of certification infrastructure. Certification frameworks help. But a certification is an assessment conducted at a point in time, by a defined set of reviewers, against a defined threat model. The internet does not respect that model. It sends every attacker in the world — simultaneously, continuously — against your system the moment it is reachable.

The D.C. case is proof of the gap. Not because D.C. was irresponsible, but because the team that broke in wasn't a foreign intelligence service. They were academics with a few days and a research budget. If a university team can seize control and swap every ballot in 48 hours, a state-level attacker with months of preparation and a dedicated staff would not need a fight song to announce their presence. They would leave none.

The New South Wales lesson: cleared doesn't mean clean

D.C.'s saving grace was that the testing happened before real ballots were inside the system. Not every jurisdiction has been that lucky.

In March 2015, New South Wales ran its iVote online voting system during a live state election. By the time independent researchers J. Alex Halderman and Vanessa Teague published their analysis, approximately 280,000 votes had already been cast. Their findings: iVote loaded code from an external analytics server over a connection vulnerable to then-known TLS weaknesses, meaning a network attacker could have manipulated votes and compromised ballot privacy. The telephone-based verification service voters could use to confirm their vote was itself susceptible to manipulation — defeating its purpose as a check. A prior closed security review had cleared the system. The researchers found the problems anyway, from the outside, during a live election. Fixes were deployed while voting was still underway. But 280,000 people had already voted on a system whose integrity could not be independently confirmed at the time they voted.

Read the researchers' analysis here.

That is the difference between D.C.'s model and the alternative. One system was broken and caught before it mattered. One was broken and discovered mid-flight.

The cryptography problem: even "verifiable" can be faked

Maybe you are thinking: the fix is end-to-end verifiable cryptography. Build a system where voters can check their own ballots, and independent mathematicians can confirm the tally without seeing anyone's vote. That is the right direction — but the cryptography has to be right.

In 2019, ahead of planned use in binding Swiss votes, Swiss Post and its vendor Scytl published the source code of their internet voting system for public scrutiny. Independent researchers Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague found something extraordinary: the mixnet's shuffle proof relied on a trapdoor commitment scheme. An authority who knew the trapdoor values could generate a proof that looked mathematically correct — that would pass verification — while actually having swapped votes underneath it. The researchers called their report "Ceci n'est pas une preuve." (This is not a proof.) Swiss Post and Scytl acknowledged the finding. Switzerland suspended the system pending remediation.

Read the researchers' findings here.

The flaw was invisible in a certified black box. It became findable the moment the source code and cryptographic proofs were published for independent review. A verifiability claim is only meaningful when outside experts can inspect it and confirm it — or disprove it. The moment inspectability is removed, the claim becomes an article of faith.

This is why D.C. doing an open public test was the right instinct, even if the result was painful. It is why Switzerland publishing its source code was the right instinct, even though the result was a caught trapdoor. The right model hurts when it works — because it finds what closed models miss.

What Estonia taught us about "nobody found anything"

Estonia has run binding national internet voting since 2005. Its system is often cited as the gold standard of i-voting: high uptake, technically sophisticated, available to all citizens with an e-ID card. The Estonian election authority has consistently defended it.

In 2014, an independent research team — Springall, Finkbeiner, Durumeric, Kitcat, Hursti, MacAlpine, and Halderman — observed the system's operation during the October 2013 municipal elections and examined the published client software and server configuration. They found serious operational and procedural security weaknesses, including lax security practices captured in the authority's own official videos. Their peer-reviewed conclusion, published at ACM CCS 2014: a well-resourced attacker — or a dishonest insider — could plausibly compromise the integrity of votes without detection. They recommended Estonia discontinue the system. Estonia's authorities disputed the conclusions.

Read the full analysis here.

Here is the critical point: the researchers could do this analysis only because the system's code and procedures were at least partly public. Had the system been a fully closed proprietary box, there would have been nothing to analyze. The absence of a finding in that case would have meant: we couldn't look, not there's nothing there.

"Nobody found anything" and "we prevented anyone from looking" are not the same statement. They produce identical official press releases.

Why Norway walked away without a scandal

Norway ran internet-voting pilots in 2011 and 2013, in ten and then twelve municipalities, as a supplement to paper voting. The trials did not lead to increased turnout. In 2014, the Ministry of Local Government and Modernisation decided to discontinue further pilots. The government concluded that, absent broad political support for full internet voting, spending further time and money on pilots was not appropriate — and cited unresolved trust concerns alongside the turnout data.

The ministry's official statement is here.

Norway's decision draws less attention than D.C.'s fight song or Switzerland's trapdoor. There was no dramatic breach. There was just an honest accounting: we could not secure trust that votes were not altered, turnout did not improve, and the cost of continuing without resolving the trust question was not worth it.

That is a mature institutional response. It is also a template that is almost never followed, because politicians who championed a technology rarely want to be the ones who shut it down.

The adversarial testing model: what Brazil got right

There is a better model than closed certification, and Brazil has been running it since 2009.

Brazil's Superior Electoral Court (Tribunal Superior Eleitoral) runs an official Public Security Test — the Teste Público de Segurança dos Sistemas Eleitorais — regulated by TSE Resolution 23.444/2015 and held in the year before general elections. Any eligible citizen whose test plan is approved can probe the electronic voting machine and related systems for weaknesses. The systems open to testing span the entire electoral lifecycle: ballot-media generation, voting, tabulation, file transmission, and audit systems. Findings are used to improve the systems, and fixes are re-checked before the election.

The TSE's official program page is here.

Brazil does not claim its machines are impenetrable. It claims something more credible: come try to break them, and we will fix what you find. That is an institutionalized version of exactly what D.C. did once, except D.C. did it once and Brasil does it as standard practice before every election cycle.

The German Federal Constitutional Court articulated the underlying principle in 2009 when it banned the use of voting computers whose operation could not be examined "by the citizen reliably and without any specialist knowledge." The court's standard was not "an expert certified it." It was: an ordinary citizen must be able to verify the essential steps. Read the judgment here. That is a higher bar than any single certification can meet — and a lower bar than internet voting currently clears.

What wasn't verifiable in D.C. — and still isn't most places

Washington, D.C.'s open trial did everything right and still nearly produced a catastrophic breach of a live election. The fight song saved it — not because it proved the system failed, but because it was loud enough that officials eventually noticed. A real attacker changes ballots silently. A real attacker does not announce themselves.

The D.C. case is not a reassurance. "We tested it publicly and found a critical flaw before it ran" is the best possible outcome of public adversarial testing — and that best possible outcome is still: the system was broken. The lesson is not that open testing guarantees a safe system. The lesson is that without open testing, you cannot know whether the system is broken until a real election has already run on it.

The deeper issue remains open everywhere internet voting is deployed or proposed: who checked the code? Who tried to break the server? Who verified the cryptographic proofs? And can you — not a vendor, not an official, not a certified lab — check any of this independently?

When the answer is no, "the system passed its security review" and "the Secretary of State says it's fine" are the same reassurance in different fonts.

An election result should not depend on trusting the vendor, the officials, or the certifying body. It should depend on a published, independently checkable chain of evidence that anyone with the right skills can verify — and that anyone who finds a flaw can prove publicly, the way Halderman's team did in 2010, the way Lewis, Pereira, and Teague did in 2019, the way every open adversarial test is designed to enable.

That is not an impossibly high bar. It is the bar that D.C. accidentally set when it invited the public in. The fight song was the sound of that bar working.

A vulnerability caught in public testing is a fixed defect. A vulnerability never tested is a silent one — and silence is not the same as safety.

See how common this transparency gap is across different systems and countries →

Read the 2-minute version of what makes an election verifiable →

Explore documented gaps in election verifiability →

Sources

See all postsExplore the gaps