With vote by mail under fire, election officials seek help from SaaS ballot tracking

As election officials around the country race to ramp up mail-in voting ahead of this November's general elections, they're taking a number of steps to ensure their systems run efficiently and securely. Yet even in the best-run systems, there are occasional glitches. 

In Denver County in 2010, for instance, a county official became alarmed when she received a notification that she should have received her ballot in the mail -- but it never came. She reached out to Steve Olsen, whose software development firm worked with the city of Denver in 2009 to build a ballot-tracking system. 

"We went with her to the USPS bulk mail processing center, and after a very informative tour and discussion, we were told a pallet of ballots had been pushed aside and forgotten for a few days," Olsen told ZDNet. 

The missing ballot was in that batch, waiting to be processed. The delay occurred well before election deadlines and ultimately didn't really impact voters, Olsen said. Still, he argues, the incident underscored how their ballot-tracking application, which was in its pilot phase at the time, could give voters and election officials alike more confidence in mail-in voting. 

More on technology and elections: 

"It did reveal the power of our system to provide visibility and accountability to all parties," Olsen said. 

Since then, Olsen's firm has tracked ballots for more than 300 elections across the US with "no other incidents or concerns," he said, nor has it had any security breaches. 

Creating a sense of accountability may be one of the hardest parts of establishing a mail-in voting system this year, as President Trump seeks to undermine the process. 

The state of Michigan, for instance, has been preparing for a deluge of mail-in ballots -- mail-in voting for the general election is expected to be twice as high as previous records in the state, according to Michigan Secretary of State Jocelyn Benson.

"We're prepared, if not over-prepared," Benson said during a recent online panel discussion. "I'm confident we're doing everything humanly possible to ensure secure and safe elections in Michigan." 

That said, she added, "what we can't control are narratives and misperceptions and disinformation that people with large bully pulpits... will utilize to sow seeds of doubt in the electorate about the sanctity of the process."

Even without political interference, setting up election infrastructure of any kind is no small task. 

"No voting system is simple—there are particular processes and procedures specific to any method," Paul Gronke, professor of political science at Reed College and director of the Early Voting Information Center, said in an email to ZDNet. "For example, under mail-in voting, you need procedures to process the volume of mail you are receiving, and in large jurisdictions, that involves specialized hardware, signature verification systems, etc."

Ballot tracking, he said, is "a useful tool for security, so citizens know when the ballots are sent and returned."

After working solely with the city of Denver for a few years, Olsen in 2012 spun out his software application into BallotTrax, a multi-tenant system open to different jurisdictions. The patent-pending BallotTrax is one of two ballot-tracking systems commonly used in the US, along with Ballot Scout, a web application developed by the nonprofit organization Democracy Works.

A few years ago, Olsen moved BallotTrax to Amazon Web Services for a number of reasons, he said, including security and scalability. 

Since the COVID-19 pandemic struck, Olsen said he's been busy fielding calls from hundreds of counties across the US, as well as from state officials. BallotTrax currently has statewide contracts with Colorado and California, and it has pending contracts in a handful of other states. BallotTrax is also used at the county level in 10 other states across the US, and the firm is working with the National Vote at Home Institute to deploy ballot tracking services in new jurisdictions. 

While BallotTrax's customers are election administrators, voters are the initial end users of the system. To opt into ballot tracking, voters provide an app or web interface with their name and date of birth, and they pick their preferred method of communication -- email, text or voice messaging. The system supports notifications in 14 different languages. 

Election officials can customize the messages that are delivered via BallotTrax, but there are typically about seven different types of notifications that go out. The notifications begin when a ballot is printed and mailed, they can track the ballot through the postal stream, and they alert voters when their ballot is rejected or accepted by election officials. 

BallotTrax relies on three different data streams. First, it consumes voter record data coming from the state, such as eligibility files and voter registration information. Next, the system uses data from the US Postal Service's Intelligent Mail barcodes, which anyone can subscribe to in order to track pieces of mail. Lastly, BallotTrax uses data it receives from the printing vendor when a ballot is created. 

See also: Voting during 2020 election: What you need to know about vote by mail, online ballots, polling places CNET

The first category of data, collected from the state, is updated three or four times a day, Olsen said. BallotTrax uses fully encrypted FTP sites to transfer the data -- it's encrypted in transit and at rest and protected by redundant firewalls. Olsen said the application's code is tested every hour, and the company actively monitors for threats using a variety of industry-standard tools.

The software is in compliance with NIST 800-171 standards for government contractors, and BallotTrax is a member of the Elections Infrastructure Information Sharing and Analysis Center. 

"Security is a big deal," Olsen said. "We're only processing voter registration data which is kind of available in lots of places, but we recognize that voting and elections are of paramount importance to voters. We don't sell their data, we don't store their data afterwards -- it's consumed, messages are sent out, and then it's deleted."

A number of the alleged concerns about fraud and tampering with mailed-in ballots can be mitigated with tracking, Olsen contends. For instance, the Trump administration and the GOP have raised objections in court to the practice of "ballot harvesting" -- letting a third party pick up and submit your ballot for you. Along the same lines, Trump has railed against mail-in voting, claiming that "mail boxes will be robbed."

However, Olsen said, if a voter "mailed their ballot back but they never get a notification it's been accepted, then they know something's wrong, and they can alert the election office." Or if a voter's signature doesn't match their signature on record, a quick BallotTrax notification "gives you some time to cure it."

"I don't see how most of those arguments are valid if a state takes the time and effort to go through adding ballot tracking and transparency," he said. 

The system has additional benefits for election administrators. While voters must opt in to receive notifications, administrators can use a BallotTrax dashboard to track all mailed ballots within their jurisdiction. As the incident in Denver in 2010 illustrated, officials can use that visibility "to find out if there are issues in the postal stream that may become impactful later," Olsen said. 

Election officials can also use the BallotTrax dashboard to gain insight into voter turnout and demographic trends. 

Meanwhile, both voters and election officials benefit simply from a greater sense of confidence in the process, Olsen said. Back in Denver, before ballot tracking was deployed, election officials were receiving calls from around one out of every four voters inquiring about their mailed-in ballots, Olsen said. After tracking was implemented, only around one out of every 20 voters called in. 

"We were answering voters' concerns before they even asked," Olsen said.