VotingWorks Partners with Security Compass to Secure Risk-Limiting Audit Software Arlo
Arlo, assessed by Security Compass, was used to support Georgia’s full hand-count audit.
Arlo, a secure and open-source election audit tool developed byVotingWorks, received high marks in a recent third-party security assessment. Arlo was a key component of the state of Georgia’s risk-limiting audit (RLA) in mid-November, and is the only software of its kind, allowing any state to carry out a risk-limiting audit. InGeorgia’s case, the audit required reviewing all five million ballots– the largest full hand-count in recent American history.
VotingWorks has been developing Arlo for the last 18 months with support from the U.S. Department of Homeland Security, Democracy Fund, and Schmidt Futures. An RLA is the gold standard of tabulation audits, where a randomly selected sample of ballots is reviewed by audit boards. An RLA tells us that, if all ballots were counted by hand, the winner declared by the tabulators would be confirmed.
The security assessment on Arlo was performed by SecurityCompass, a leading provider of cybersecurity solutions and advisory services. The assessment, which included a comprehensive penetration test simulating attacks that could have been deployed against Arlo, was completed prior to the state of Georgia’s use of the software. Security Compass found no significant security issues during its assessment but did identify three minor issues. VotingWorks immediately addressed two of them, and a solution to the third is in the works, though it poses no immediate threat to Arlo.
“Since there is currently no federal standard for risk-limiting audit software, VotingWorks wanted to partner with a preeminent security firm to provide a strong and independent review of our Arlo code and operations,” said VotingWorks Executive Director Ben Adida. “No software is perfect, and security is an ongoing process – not just a one-time evaluation. Security Compass identified areas where we can make Arlo even more secure and we look forward to having SecurityCompass’ ongoing support and guidance.”
As part of VotingWorks’ commitment to transparency, we are releasing the complete security report.
“Given the importance of vote-auditing software, it is absolutely critical that we continuously identify and address risks for platforms like Arlo,” said Jordan Kendall, GM Advisory Services, SecurityCompass. “We were glad to help build confidence in the 2020 election results by testing the security of software designed by an innovative and transparent organization like VotingWorks. We look forward to continuing our work to ensure that the Arlo platform remains an industry leader in election security and reliability.”
In addition to Georgia, Arlo has been used in Rhode Island andCalifornia, and will be used in upcoming pilot RLAs in Michigan andPennsylvania. Anyone can download and use Arlo for free. VotingWorks provides optional implementation, support, and hosting services to states.