The unique challenges of authenticating poll workers

The 2016 and 2020 campaigns thrust election security into the limelight. Accusations of foreign interference and individual domestic election fraud became major concerns for citizens and politicians on both sides of the aisle. With the future of our democratic institutions being called into question, security professionals across the country are racing to find the best methods for restoring faith in the process. While many individuals question the integrity of voting machines, the problem of hackers remotely accessing these devices is slim, as they are typically not connected to the internet at all. This leaves security pros to examine the people conducting the elections and how they can influence the outcome.

Every year hundreds of paid and volunteer workers show up to coordinate the nation’s elections. One report from the Election Assistance Commission (EAC) estimates that 917,694 poll workers were employed across 116,990 locations in the 2016 election alone. Federal investigations are now putting worker’s actions during the 2020 election under a microscope, with ongoing fraud investigations in Colorado, Georgia and Michigan. In Georgia, election workers allowed employees from the data solutions firm SullivanStrickler unauthorized access into government offices to copy voting data off of hard drives in the voting machines. Officials are concerned that this copied data could be exploited to impact the results of future elections. 

The first step in securing elections is managing who has access to the sensitive data behind them.

Diversity and access

Establishing identity and access management (IAM) solutions for poll workers ensures that the right people have the right access to the systems they need to run the elections. Also, there must be ways to identify who was where in the event of an election fraud investigation. Polling workers are a diverse group. They stretch across all age groups, races and socioeconomic classes. That said, there are some distinct patterns among those traditionally working our nation’s elections. According to the EAC, 56% of poll workers are 61 or older, and this means that whatever authentication method is used, it must be accessible to an older population.

Like security in other sectors, passwords alone won’t provide the level of security necessary to safeguard critical data. Passwords can be easily breached, phished or passed on, and they do little to verify the identity of the individual accessing the system. This means it’s necessary to add a second layer of authentication to the process. One-time passwords (OTPs), received/generated on a smartphone, are the most common form of authentication used as a second factor; however, these are not accessible to everyone, especially in the poll worker’s most common demographic. According to Pew, only 61% of people 65+ own a smartphone, meaning smartphone-based authentication methods won’t work for the older population who make up the bulk of poll workers. Having an egalitarian option that allows people from all walks of life to participate in the polls is essential to the democratic nature of elections.

Similarly, hardware tokens are a no-go in this case. Aside from the prohibitive costs (hardware tokens can cost upwards of $600,000 for every 25,000 users alone), tokens present the same problem as passwords — they are easily shared. A hardware token can be handed to a poll worker, then can easily be passed to another, either deliberately, or by being lost or stolen. Once the token leaves the hands of the person it was issued to, there is no way for election officials or federal investigators to identify the person who used it to gain access to sensitive election data. 

Simplifying the solution

Rather than complicating election security with personal devices and hardware tokens, biometrics present an opportunity to simplify the process. By installing fingerprint scanners on the devices used by poll workers, election officials can authenticate and keep track of exactly who completes each action. This would require a centralized biometric method, like identity-bound biometrics (IBB), whereby the user’s fingerprint is enrolled not on the device, but with the government agency holding the election. By enrolling the fingerprint centrally, investigative bodies and election oversight committees would be able to see beyond which device is completing a task and be able to identify the specific individual. 

This solution would further simplify election security by eliminating the need for passwords. All election workers would need to access voter information is a simple fingerprint scan. This system guarantees access for all poll workers, from high schoolers helping out in their free time to the older adults that make up the bulk of the workers -- no special knowledge or independent device is needed. Records are accessed by something unique to each poll worker, which is both more convenient for them and more secure for oversight committees and investigators. 

Elections represent a unique challenge for security professionals. On the one hand, any system for authenticating poll workers must be able to work for any volunteer nationwide. On the other, the utmost care must be taken to secure critical election data to maintain the integrity of elections. Instituting a centralized biometric system empowers authorized users to access their work with the touch of a finger while maintaining the security necessary to keep faith in the nation’s most important civic duty.