While millions of Americans cast their ballots inside a local polling place, many overseas service members and citizens rely on a ballot delivered or returned digitally. The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) largely runs on electronic transmission: allowing voters to register, access a blank ballot, and, if a state allows it, return materials online. That digital channel is a polling place in its own right, and it requires the same commitment to accessibility and security as any physical polling location.
What makes securing your UOCAVA system difficult is that you cannot lock it down the usual way. A county website can often block standard web traffic from outside the United States without impacting a single voter. A UOCAVA system cannot. A U.S. soldier in Germany or a U.S. civilian in Costa Rica has to access the system from a foreign IP address, so simple defenses do not apply. The challenge is to keep the door open for the right people without letting it become an opening for disruption.
A few critical moves matter most:
- Keep the system up. A denial-of-service attack, the kind that floods a website until it falls over, can lock out overseas voters during the short window they have to act. Ask your system provider or your state how the system holds up under heavy loads and what the plan is if it goes down.
- Verify that traffic from overseas is allowed. Some jurisdictions and service providers will restrict traffic from foreign nations as a matter of routine cybersecurity protections, particularly from countries with a demonstrated history of malicious cyber activity. UOCAVA voters seeking election information may have difficulty accessing your website in blocked locations. Ask your network administrator what options are available to bypass default network blocks and allow legitimate U.S. citizens to access your online systems used by UOCAVA voters.
- Scan everything that comes in. Returned materials usually arrive as attachments or uploads. Treat every file as suspect and scan it before anyone opens it. Consider opening UOCAVA-related emails on a separate device such as a tablet.
- Verify the voter, not just the ballot. Confirm that the person on the other end is the registered voter by using the identity checks your state requires while maintaining a secret ballot.
These are basic steps with extra care, because the UOCAVA channel is open to the whole world by design. Do them well, and the virtual polling place should hold up just like the physical ones.
The Planning Desk is a running timeline of key election security tasks. You can find prior editions in the newsletter archive.