Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Internet Voting - Trust Us, It's Secure

Barbara Simons

PolicyVoting Village46 minBeginner
Watch on DEF CON media

This recording is not on YouTube. It plays from the DEF CON media server; the button opens the file there.

Where

Voting Village
DEF CON 34

Duration

46 min

Makes the case that internet voting cannot be secured or verified, using past pilot breaches, failed trials and expert reviews as evidence.

Summary

The talk opens with the speaker's own change of view: a 1999 National Science Foundation workshop convinced her that returning voted ballots over the internet could not be made safe. She defines internet voting as sending a completed ballot electronically, by web, email or fax, and notes that 33 states plus the District of Columbia allow some form of it, mostly for overseas and military voters. Her core objection is that the secret ballot leaves voters no way to confirm that a ballot arrived and was counted correctly.

The middle of the talk is a run of case studies. A 2004 review of the SERVE overseas system led to its cancellation. A 2010 District of Columbia test was broken by university researchers who changed cast ballots and reached into the surrounding network. Australia's iVote system drew repeated flaw reports, and the Voatz mobile app was shown to let attackers alter votes. Canadian and Swiss studies found no turnout gain from online voting, and Estonia's long-running system was questioned in later analyses. Vendors often answered critics by disputing findings or pushing to discredit them.

She closes with a practical list: hand-marked paper ballots, strong chain of custody, risk-limiting audits, honest officials, and no internet return of ballots. For overseas and disabled voters, she urges officials to promote blank-ballot downloads and remote accessible vote-by-mail instead.

Materials

Related talks

Voting Village·26 min

  • DEF CON
  • Policy
  • Date: Aug 2026
  • Location: Las Vegas

Richard DeMillo

Argues that election security failures persist when known vulnerabilities become normalized, drawing on the Challenger and Columbia investigations and a Georgia voting lawsuit.

villageriskvulnerabilities+2