Election registration APIs: what it means when device trust fails

TL;DR: Election authorities face a voter-registration fraud problem when mobile APIs cannot distinguish real citizens from bots, emulators, and scripted traffic, according to Approov, which describes a case where layered app attestation and bot management blocked every fraudulent attempt. Trust at the API edge becomes a governance control, not just a fraud control.

Editorial analysis by NHI Mgmt Group, based on content published by Approov: “Defending Democracy: How Mobile App Attestation Blocked Automated Voter Fraud”.

By the numbers:

• 100% of emulator-based, fraudulent registration attempts were automatically blocked.

Key questions

Q: What breaks when mobile APIs cannot verify the originating device?

A: When a mobile API cannot verify the originating device, automated clients can mimic legitimate users and submit fraudulent requests at scale.

Q: Why do bot controls alone miss some mobile API abuse?

A: Bot controls detect automation patterns, but they do not always prove the request came from a legitimate app on a trusted device.

Q: How should security teams govern mobile registration APIs in high-trust workflows?

A: Teams should govern mobile registration APIs as identity-critical services.

Practitioner guidance

• Implement app attestation for voter-facing workflows Require server-side proof that the request came from an unmodified official app on a trusted device before the API processes registration or ballot requests.
• Add bot filtering to the outer API layer Use network-level controls to block emulator traffic, scripted requests, and abnormal request bursts before they reach identity enrolment endpoints.
• Separate high-trust registration flows from general mobile traffic Place additional verification on workflows that can create, modify, or activate citizen records so automation cannot blend into normal app usage.

Bottom line: Mobile registration channels can be abused when APIs accept traffic without verifying app integrity and device authenticity.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →