Update on Independent report on Estonia’s e-voting

On Saturday 10th May we (the Independent Team) informed key stakeholders in Estonia that we would be reporting our findings the coming Monday. We contacted the Estonian Elections Committee, other officials and agencies as well as media. We did this impartially and openly to avoid being seen to favour any one political party or media source.

Late on Sunday 11th May we launched our website summarising the findings and supporting them with photos and videos.

On Monday 12th May we held a press conference – to which there had been an open invitation – to present our findings and answer questions from anyone who wanted to. That day a first response to our work was posted by the Estonian Electronic Voting Committee’s Facebook page, to which we responded.

On Tuesday 13th May we met privately with members of the Estonian Electronic Voting Committee (which is part of the overall Elections Committee).  There we talked through our findings and shared technical details of issues and vulnerabilities that will not be published until the current elections are over. We also assured them that we would not publish any demonstration code until after the election, and would not interact with the live voting system if they chose to proceed with using it for the European Parliamentary elections. They confirmed they would proceed with using their system. I was particularly surprised when the Electronic Voting Committee members said they could think of no circumstances in which they wouldn’t proceed with using their system.

The same day the Elections Committee published a lengthy response to The Guardian’s reporting of our findings. We responded in full here.

Since Monday we have had significant interest from a range of people in Estonia’s tech industry who we have met or corresponded with. We have also seen local and international media reporting on our findings.

Sadly, despite repeated requests, we have not been able to meet with representatives of the Estonian government nor the key Parliamentary committees with oversight on these issues. The Estonian Prime Minister and President have used the media (and social media) to dismiss our work and suggest we are working to favour one political party over another in Estonia. That simply isn’t true, such a response would appear to be a case of trying to shoot the messenger rather than hear some uncomfortable truths.

On Saturday 17th May we published the detailed technical analysis report to expand on and support the findings we had published a week earlier. The paper has also been submitted to an academic conference.

• Read the full technical report
• Listen to or watch the Press Conference

I have been pleased to see such widespread discussion of our findings. However some have sought to shut down the debate by seeking to query our independence and integrity. These claims have no truth and team members have a strong record of examining the security of e-voting systems around the world without any fear or favour for political parties of any type.

Some have suggested that Estonia is uniquely able to deliver secure online voting because of their universal ID smartcards and cyberwar protections. They would argue that no other country than Estonia has the infrastructure to use online voting. Whilst I agree that Estonia has a highly developed online infrastructure, which is incredibly exciting for e-government applications, even that isn’t enough for the uniquely difficult problem of online voting.

The debate is for Estonian citizens to have now with input from the EU and NATO where they have obligations as a member-state. If I was an Estonian I would be voting on paper but happily making use of their online services for tax, health and more.