By now you’ve probably heard about the app. Everyone in America hates the app that was used — or, I guess, not used — in the Iowa caucuses, leading to a delay in the vote count. Maybe one day we’ll find out who won the Iowa caucus. Maybe it was me? Did I win the Iowa caucus? At this point, nobody can say I didn’t, and that’s nice.
Anyway: Amid conspiracy theories, worries about foreign interference, claims of victory made in the absence of definitive numbers, and general disorder, what is immediately clear from various media reports is that the Iowa-caucus app was crippled not by lax security, but by too much. An overcorrection from the mistakes of 2016 — when DNC servers were infiltrated by Russia-backed hackers — executed in the clumsiest way possible.
According to a copy of the software obtained by Vice, it was called the IowaReporterApp, and it was developed by a political vendor called Shadow. Unlike most apps, the Iowa-caucus app was not available on app storefronts like Google Play on Android and the App Store on iOS. Instead, caucus chairs had to sideload the app onto their phones, bypassing the storefronts. Many technology companies use these systems when conducting beta tests prelaunch. On Android, users were asked to do this using an enterprise system called TestFairy. iOS has an equivalent system called TestFlight.
Simply installing the app proved to be a problem for many caucus chairs who weren’t immediately fluent in app sideloading. In the Washington Post yesterday afternoon, caucus chair Zach Simonson recalled, “When I’d downloaded it on January 31, the installation instructions had been convoluted: You had to fill out a survey, which then got you a link, and then you had to download a different app, and enter in a code from your email, and then you would get the real app.”
The reason for this was security. It was meant to keep unauthorized people out. Unfortunately, it also locked out the people it was meant to convenience. “Caucus chairs who need their grandkids to program their DVRs,” as Simonson put it.
A user of the Iowa app told Vice the app had a number of security measures that required more than the standard username and password. This included users punching in a rotating onetime password (a common form of two-factor authentication) and submitting their precinct PIN. The system apparently failed after the onetime password, when the app encountered an error and threw up the vague message, “Oops! Something went wrong.”
But that an unspecified something had gone wrong was about as much information as users received. Most robust software has specific error codes for specific issues, to help users diagnose the problem, but the Iowa app simply suggested “there could be a misconfiguration in the system or a service outage.” That could mean almost anything. Was the app buggy? Were the servers authenticating the login down? Had the Wi-Fi or cell reception gone kaput? It was impossible for a user — or a tech-support person trying to help them — to know.
Compounding this mystery regarding the buggy app was the mystery around who made it. We now know it was the work of Shadow, an offshoot of a progressive political firm called Acronym. But last night, that information was still only known to a select few members of the Iowa Democratic Party, who kept the vendor’s name secret. “The Iowa Democratic Party has declined to disclose some details about the app, such as the vendor that made it, saying that doing so could inadvertently help potential cyber attackers,” The Wall Street Journal reported.
The security failures of 2016 came back to haunt Democrats last night as they buried themselves in an unsustainable amount of security protocols, requiring technical novices to jump through hoops to acquire and log in to the app. Shadow didn’t effectively test it beforehand, and rushed it out the door days ago. Party officials refused to make the app’s code available to third-party experts who could verify that it was secure and that it worked. The Democrats tried to keep their election process completely secure from outside attacks and ended up shooting themselves in the foot.
Relative to technology, the political process moves at a slow pace. But the year will be full of elections, and it’s too late for Democrats to keep trying to work out the kinks, overcorrecting one way or the other. If the people in charge of our elections can’t figure out how to properly balance digital security with accessibility, then computers have no place in our electoral system. The paper ballot, Iowa’s backup, works just fine. And unlike an app, it will never be fully obsolete.
