Update on Independent report on Estonia’s e-voting

On Saturday 10th May we (the Independent Team) informed key stakeholders in Estonia that we would be reporting our findings the coming Monday. We contacted the Estonian Elections Committee, other officials and agencies as well as media. We did this impartially and openly to avoid being seen to favour any one political party or media source.

Late on Sunday 11th May we launched our website summarising the findings and supporting them with photos and videos.

On Monday 12th May we held a press conference – to which there had been an open invitation – to present our findings and answer questions from anyone who wanted to. That day a first response to our work was posted by the Estonian Electronic Voting Committee’s Facebook page, to which we responded.

On Tuesday 13th May we met privately with members of the Estonian Electronic Voting Committee (which is part of the overall Elections Committee).  There we talked through our findings and shared technical details of issues and vulnerabilities that will not be published until the current elections are over. We also assured them that we would not publish any demonstration code until after the election, and would not interact with the live voting system if they chose to proceed with using it for the European Parliamentary elections. They confirmed they would proceed with using their system. I was particularly surprised when the Electronic Voting Committee members said they could think of no circumstances in which they wouldn’t proceed with using their system.

The same day the Elections Committee published a lengthy response to The Guardian’s reporting of our findings. We responded in full here.

Since Monday we have had significant interest from a range of people in Estonia’s tech industry who we have met or corresponded with. We have also seen local and international media reporting on our findings.

Sadly, despite repeated requests, we have not been able to meet with representatives of the Estonian government nor the key Parliamentary committees with oversight on these issues. The Estonian Prime Minister and President have used the media (and social media) to dismiss our work and suggest we are working to favour one political party over another in Estonia. That simply isn’t true, such a response would appear to be a case of trying to shoot the messenger rather than hear some uncomfortable truths.

On Saturday 17th May we published the detailed technical analysis report to expand on and support the findings we had published a week earlier. The paper has also been submitted to an academic conference.

I have been pleased to see such widespread discussion of our findings. However some have sought to shut down the debate by seeking to query our independence and integrity. These claims have no truth and team members have a strong record of examining the security of e-voting systems around the world without any fear or favour for political parties of any type.

Some have suggested that Estonia is uniquely able to deliver secure online voting because of their universal ID smartcards and cyberwar protections. They would argue that no other country than Estonia has the infrastructure to use online voting. Whilst I agree that Estonia has a highly developed online infrastructure, which is incredibly exciting for e-government applications, even that isn’t enough for the uniquely difficult problem of online voting.

The debate is for Estonian citizens to have now with input from the EU and NATO where they have obligations as a member-state. If I was an Estonian I would be voting on paper but happily making use of their online services for tax, health and more.


Estonia and the risks of internet voting

Originally posted on the Open Rights Group Blog.

In my capacity as an ORG Advisory Council member I’ve been working with an independent team of election observers researching the Internet voting systems used by Estonia. Why should anyone in the UK be interested in this?

Two reasons: Firstly Estonia is regularly held up as a model of e-government and e-voting that many countries, including the UK, wish to emulate. Secondly, after years of e-voting being off the UK agenda (thanks in part to ORG’s previous work in this area), the chair of the Electoral Commission recently put the idea of e-voting for British elections back in play.

Before our or any other government leaps to copy the Estonian model, our team wanted to better understand the strengths and weaknesses of the Estonian system. So several of us monitored the internet voting in operation for Estonia’s October 2013 municipal elections as official observers accredited the Estonian National Election Committee. Subsequently the team used the openly published source code and procedures for the Estonian system to build a replica in a lab environment at the University of Michigan. This enabled detailed analysis and research to be undertaken on the replica of the real system.

Despite being built on their impressive national ID smartcard infrastructure, we were able to find very significant flaws in the Estonian internet voting system, which they call “I-voting”. There were several serious problems identified:

Obsolete threat model

The Estonian system uses a security architecture that may have been adequate when the system was introduced a decade ago, but it is now dangerously out of date. Since the time the system was designed, state-level cyberattacks have become a very real threat. Recent attacks by China against U.S. companies, by the U.S. against Iran, and by the U.K. against European telecoms demonstrate the proliferation and sophistication of state-level attackers. Estonia itself suffered massive denial-of-service attacks in 2007 attributed to Russia.

Estonia’s system places extreme trust in election servers and voters’ computers — all easy targets for a foreign power. The report demonstrates multiple ways that today’s state-level attackers could exploit the Estonian system to change votes, compromise the secret ballot, disrupt elections, or cast doubt on the fairness of results.

Abundant lapses in operational security and procedures

Observation of the way the I-voting system was operated by election staff highlighted a lack of adequate procedures for both daily operations and handling anomalies. This creates opportunities for attacks and errors to occur and makes it difficult for auditors to determine whether correct actions were taken.

Close inspection of videos published by election officials reveals numerous lapses in the most basic security practices. They appear to show the workers downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing election software for distribution to the public on insecure personal computers, among other examples. These actions indicate a dangerously inadequate level of professionalism in security administration that leaves the whole system open to attack and manipulation.

Serious vulnerabilities demonstrated

The authors reproduced the e-voting system in their laboratory using the published source code and client software. They then attempted to attack it, playing the role of a foreign power (or a well resourced candidate willing to pay a criminal organization to ensure they win). The team found that the Estonian I-voting system is vulnerable to a range of attacks that could undetectably alter election results. They constructed detailed demonstration attacks for two such examples:

Server-side attacks: Malware that rigs the vote count

The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.

The researchers demonstrated that they can infect the counting server with vote-stealing malware. In this attack, a state-level attacker or a dishonest election official inserts a stealthy form of infectious code onto a computer used in the pre-election setup process. The infection spreads via software DVDs used to install the operating systems on all the election servers. This code ensures that the basic checks used to ensure the integrity of the software would still appear to pass, despite the software having been modified. The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.

Client-side attacks: A bot that overwrites your vote

Client-side attacks have been proposed in the past, but the team found that constructing fully functional client-side attacks is alarmingly straightforward. Although Estonia uses many security safeguards — including encrypted web sites, security chips in national ID cards, and smartphone-based vote confirmation — all of these checks can be bypassed by a realistic attacker.

A voter’s home or work computer is attacked by infecting it with malware, as millions of computers are every year. This malicious software could be delivered by pre-existing infections (botnets) or by compromising the voting client before it is downloaded by voters by exploiting operational security lapses. The attacker’s  software would be able to observe a citizen voting then could silently steal the PIN codes required to use the voter’s ID card. The next time the citizen inserts the ID card — say, to access their bank account — the malware can use the stolen PINs to cast a replacement vote for the attacker’s preferred candidate. This attack could be replicated across tens of thousands of computers. Preparation could being well in advance of the election starting by using a replica of the I-voting system, as the team did for their tests.

Insufficient transparency to establish trust in election outcomes

Despite positive gestures towards transparency — such as releasing portions of the software as open source and posting many hours of videos documenting the configuration and tabulation steps — Estonia’s system fails to provide compelling proof that election outcomes are correct. Critical steps occur off camera, and potentially vulnerable portions of the software are not available for public inspection. (Though making source code openly available is not sufficient to protect the software from flaws and attacks.) Many potential vulnerabilities and forms of attack would be impossible to detect based on the information provided to the public. So while the researchers applaud attempts at transparency, ultimately too much of how the I-voting system operates is invisible for it to be able to convince skeptical voters or candidates in the outcomes.

To illustrate this point, the team filmed themselves carrying out exactly the same procedural steps that real election officials show innearly 24 hours of videos from the 2013 elections. However, due to the presence of malware injected by the team before the recordings started, their count produces a dishonest result.

Recommendation: E-voting should be withdrawn

After studying other e-voting systems around the world, the team was particularly alarmed by the Estonian I-voting system. It has serious design weaknesses that are exacerbated by weak operational management. It has been built on assumptions which are outdated and do not reflect the contemporary reality of state-level attacks and sophisticated cybercrime. These problems stem from fundamental architectural problems that cannot be resolved with quick fixes or interim steps.

While we believe e-government has many promising uses, the Estonian I-voting system carries grave risks — elections could be stolen, disrupted, or cast into disrepute. In light of these problems, our urgent recommendation is that to maintain the integrity of the Estonian electoral process, use of the Estonian I-voting system should be immediately discontinued.

Our work shows that despite a decade of experience and advanced e-government infrastructure Estonia are unable to provide a secure e-voting system. So we believe other countries including the UK should learn from this that voting is a uniquely challenging system to provide online whilst maintaining the fundamental requirements of fair elections: secrecy of the vote, security and accuracy. The significant costs of attempting to build such a system would be better directed at other forms of e-government which can provide greater and more reliable benefits for citizens without risking the sanctity of elections.

Read and watch more about this work at




Press Release: Independent Team finds serious vulnerabilities in Estonian Internet Voting System

Ahead of European Parliamentary elections an International team of independent experts identifies major risks in the security of Estonia’s Internet voting system and recommends its immediate withdrawalEstonia’s Internet voting system has such serious security vulnerabilities that an international team of independent experts recommends that it should be immediately discontinued.The team members, including Jason Kitcat from the UK’s Open Rights Group, were officially accredited to observe the Estonian Internet voting system during the October 2013 municipal elections. These observations — and subsequent security analysis and laboratory testing — revealed a series of alarming problems.  Operational security is lax and inconsistent, transparency measures are insufficient to prove an honest count, and the software design is highly vulnerable to attack from foreign powers.

Estonia is the only country in the world that relies on Internet voting in a significant way for national elections. The system is currently used for Estonia’s national parliamentary elections, municipal elections and is planned to be used for the May 2014 European Parliamentary elections. In recent polls, 20-25% of voters cast their ballots online.

Independent security researcher Harri Hursti, who observed operations in the election data center during October 2013, said there were numerous security lapses. “We didn’t see a polished, fully documented procedural approach of maintaining the back-end systems for these online elections,” said Hursti. Videos published by election officials show the officials downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing the election software for distribution to the public on insecure personal computers.  “These computers could have easily been compromised by criminals or foreign hackers, undermining the security of the whole system” Hursti said.

Assistant Professor J. Alex Halderman from the University of Michigan, pointed to fundamental weaknesses in the I-voting system’s design.  “Estonia’s Internet voting system blindly trusts the election servers and the voters’ computers”, Halderman said.  “Either of these would be an attractive target for state-level attackers.”  Recent reports about state-sponsored hacking of American companies by China and European telecoms by the NSA demonstrate that these dangers are a reality, Halderman explained.

To experimentally confirm these risks, Halderman and his Ph.D. students recreated the Estonian “I-voting system” in their laboratory based on the published software used in 2013.  They successfully simulated multiple modes of attacks that could be carried out by a foreign power. “Although the Estonian system contains a number of security safeguards, these are insufficient to protect against the attacks we tried,” said Halderman.

In one attack, malware on the voter’s computer silently steals votes, despite the systems’ use of secure national ID cards and smartphone verification.  A second kind of attack smuggles vote-stealing software into the tabulation server that produces the final official count.  The team produced videos in which they carry out exactly the same configuration steps as election officials — but with the system under attack by a simulated state-level adversary.  Everything appears normal, but the final count produces a dishonest result.

“There is no doubt that the Estonian I-voting system is vulnerable to state-level attackers, and it could also be compromised by dishonest election officials,” said Halderman.  These attackers could change votes, compromise the secret ballot, disrupt voting, or cast doubt on the legitimacy of the election process.

The team recently arrived at these results and were so alarmed that they decided to urgently make their findings public ahead of the upcoming European elections, explained Jason Kitcat from the Open Rights Group.  “I was shocked at what we found,” explained Kitcat.  “We never thought we’d see as many problems and vulnerabilities as we did. We feel duty-bound to make the public aware of those problems.”

While some of the problems can be corrected in the short term through changes to the system, others stem from fundamental weaknesses that cannot be fixed.  With the growing risk of state-level cyberattacks, the team unanimously recommends discontinuing Internet voting until there are fundamental advances in computer security.

“With today’s security technology, no country in the world is able to provide a secure Internet voting system,” said Hursti.  “I would recommend that Estonia return to a paper ballot only system.”

Maggie MacAlpine, a Post-Election Audit Advisor said, “While Estonia has an excellent e-government system, which they should continue to develop, they should take the Internet voting element of that off-line. Estonia has a well organized paper voting system which they should revert back to.”

The full report and videos explaining the key findings will be published at


For queries contact or Jason Kitcat at +44 7956 886 508.

The report authors are:

J. Alex Halderman, University of Michigan*
Harri Hursti, Independent Security Researcher*
Jason Kitcat, Open Rights Group*
Maggie MacAlpine, Post-Election Audit Advisor*
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan

* Authors who acted as election observers for 2013 Estonian local elections




Flaws found in Estonian internet voting system – PRESS CONFERENCE by independent team on this Monday 12th May in Tallinn, Estonia

PRESS CONFERENCE 12th May 2014 11:00am — Hotel Metropol, Tallinn

International Team of Independent Election Observers to deliver report on Estonian Internet Voting System

TALLINN, Estonia — An international team of independent experts will deliver their findings on the security of the Estonian E-Voting System this Monday.

This team of renowned experts on computer security and voting systems observed the use of Internet Voting in the 2013 Estonian municipal elections. Ahead of the 2014 European Elections, which plan to use the same internet voting system in Estonia, the International experts will introduce a report in which they explain their observations from 2013 and the results of their security analysis. Their analysis has identified serious flaws in the systems and processes used in Estonian internet voting.

The entire team will be at the press conference and available for interview afterwards to present and discuss their findings.


For queries contact Jason Kitcat on or +44 7956 886 508

* The Press conference will be in the Hotel Metropol, Roseni 13, 10111 Tallinn, Estonia at 11am on Monday 12th May 2014. The press conference will be in English.

* The report and associated information will be later available from

* The team who produced the report and who will be present at the press conference are:
J. Alex Halderman, University of Michigan
Harri Hursti, Independent Security Researcher
Jason Kitcat, Open Rights Group
Maggie MacAlpine, Post-Election Audit Advisor
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan


notes from JK voting

Trip report – Estonia on e-voting, transport and politics

Meeting the Mayor of Tallinn
Meeting the Mayor of Tallinn, Mr Savisaar

At the beginning of February I spent three days in Estonia at the invitation and expense of Mr Edgar Savisaar, the Centre Party Mayor of Tallinn (and Estonia’s first post-Soviet prime minister). My visit had three main aims:

  1. To present some public lectures on my views and experiences opposing electronic voting. Estonia is the only country in the world to allow all citizens to vote by Internet in their Parliamentary elections.
  2. To learn more about Tallinn’s new policy of free public transport for citizens, which had launched on 1st January 2013.
  3. To explore how Estonia does local government and what I could learn from that, to build fruitful links between our universities and partners to support future investment and EU funding bids.

I spent most of the first day with Mr Savisaar including a formal lunch reception with a range of MPs, council officials and academics. Most of them shared deep concerns about the country’s internet voting system. This concern is a minority view in Estonia, especially in the Parliament. I have not had the opportunity to study the Estonian system in detail so cannot comment on specifics, but my friend and fellow e-voting campaigner Barbara Simons has posted her critical thoughts following her own visit and analysis of other reports.

My long held view against e-voting can be summarised as that the very significant risks introduced by the technology are not worth it, and the huge costs do not justify increasing electoral risks, as there are no other obvious benefits. Like the rest of Europe, Estonia has had to trim its national spending, so I found many Estonians agreeing that there were other priorities the money invested in e-voting could be better spent on.

Giving a lecture on e-voting in Tallinn
Giving a lecture on e-voting in Tallinn

Following meetings with officials detailing my experiences as ORG’s e-voting campaigns coordinator, plus sharing some ideas and contacts on how to further the Estonian campaign against e-voting, we went on to my first public lecture. This very well attended event was live translated into Estonian and Russian (there is a significant Russian-speaking population) and was recorded for a local TV station. You can see clips of the event and a follow-up interview here. Footage of the meeting earlier in the day is here and here. (I don’t know if the full video of my lecture will be released online, but it was an evolution of my 2007 presentation of ORG’s election observation which can be watched here)

The next day I had an early morning meeting with Ivar Tallo, a former MP and e-government lecturer, who is a well known supporter of Estonia’s e-voting. We had a good conversation but didn’t settle our differences for and against e-voting! Then with Priit Toobal MP, one of Mr Savisaar’s assistants and a translator we went on a small tour of the country visiting Paide city (right in the centre of the country) and Parnu (a popular coastal summer resort town). I met MPs and councillors in each place whilst also presenting a shorter version of my e-voting lecture.

All the meetings and conservations gave me some interesting insights into Estonia’s advanced e-government infrastructure, the development challenges as population is drawn inexorably towards the capital city of Tallinn along with views and experiences of Tallinn’s free public transport. I learnt from Vice-Mayor Taavi Aas that in January bus usage had jumped about 15% whilst traffic at key central junctions in Tallinn had dropped 20%. Early days yet, but interesting. I also completely ran out of brochures for the Universities of Sussex and Brighton.

With Taavi Aas, Vice-Mayor of Tallinn responsible for transport
With Taavi Aas, Vice-Mayor of Tallinn responsible for transport

I doubt many use it, but I was impressed that the Estonian infrastructure allows citizens to see who (in and out of government) has accessed their identity information with a full log and lets citizens control who can view their online medical data. Citizen-centric data management seems to be an important step towards our digital future. I would urge more investment there than in online voting methods!

I was also interested to learn that local government in Estonia is primarily funded by a share of income tax. So every 1,000 people moving into Tallinn bring in an addition €1m/year from that share. There is also some form of land value tax in use too. Compared to the broken taxation system councils in England depend on, a local share of income tax looks very simple and clear to understand indeed!

On the final day, before leaving, I had a chance to explore the streets of Tallinn a bit more. It’s a small city centre with a fascinating history involving Swedes, Germans, Russians and Dutch colonialism. Also lots of free wifi which doesn’t require frustrating registration forms, just a simple ‘I agree to T&Cs’ button to get going.

Of course one can never fully understand all the nuances in a short visit. But Brighton & Hove has now established some strong links with Tallinn and Estonia for our universities and councils to pursue. We are already looking at some joint EU bids between our councils. Meanwhile the campaign against e-voting continues.

I’d like to thank everyone who helped make my visit go so smoothly including Mr Edgar Savisaar, his assistants especially Oksana Jalakas, Priit Toobal MP, Kadri Simson MP, Taavi Aas, Allan Alaküla, Elena Sapp and many more.

View on part of Tallinn’s Old Town

UK’s central database of electors cancelled

The Cabinet Office today announced what has been pretty obvious for some years. The Co-ordinated Online Record of Electors (CORE) project is dead.

In some respects this project, previously known as LASER, was a classic government centralised database nightmare. At one point its business case depended on sales to marketing companies, but a legal challenge put an end to that (see for example page iv of this PDF), resulting in a complete rethink.

The risk of an online central database was not just of our privacy and error, but that this would become a convenient starting point for the slippery slope to online voting or an ID cards database.

On the positive side some of the work necessary would improve and standardise electoral registers across the country, potentially helping to reduce fraud and error – particularly multiple registrations and failure to notify when moving.

In my view the risks and costs outweighed the benefits. But even with CORE confirmed dead, we should still aim to standardise and improve the UK’s electoral registers, including through the use of Election Markup Language.


OSCE flag concerns with Estonian e-voting system

Emilis Dambauskas writes:

I have noticed that OSCE published final assessment report for Estonian Parliamentary Elections that happened on 6th March 2011:

Executive summary states:

Voters could cast their ballots via the Internet during the advance  voting period from 24 February to 2 March. Despite concerns raised by some interlocutors, the OSCE/ODIHR EAM in general found widespread trust in the conduct of the Internet voting by the National Electoral Committee (NEC). However, there is scope for further improvement of the legal framework, oversight and accountability, and some technical aspects of the Internet voting system.

However there are some details which make the situation smell strangely:

(page 11): During the counting, one vote was determined invalid by the vote counting application since it was cast for a candidate who was not on the list in the corresponding constituency. The project manager could not explain how this occurred – the investigation was still ongoing at the time of issuing the report.

A student demonstrated that the client-side voting application “was flawed and could make it possible for a virus to block a vote without the voter knowing that any interference had occurred”:

The report mentions various other questionable practices by the i-voting vendor (called “project manager”). I want to re-read the report, but it seems like Estonians may have privatized their elections…

Indeed privatisation is another reason to resist the introduction of e-voting, as it is much harder to scrutinise the processes and systems used. Another quote from the report rings alarm bells for me:

The vendor, Cybernetica AS, handed over the internet voting software to the NEC in December 2010. The OSCE/ODIHR [election monitoring mission] was informed that the [privately contracted] project manager was able to update the software of the Internet voting system until right before the elections started, and without a formal consent of the NEC. This was done without any formal procedure or documented acceptance of the software source code by the NEC, which limited the information on which version of the software was ultimately used.

More concerns:

As in previous elections, and despite the recommendation made by the OSCE/ODIHR in 2007, the time of casting a vote was recorded in a log file by the vote storage server along with the personal identification code of the voter. This could potentially allow checking whether the voter re-cast his/her Internet vote, thus circumventing the safeguards in place to protect the freedom of the vote.

The project manager accessed the servers for daily data maintenance and backup breaking the security seals and using a data storage medium employed also for other purposes. This practice could potentially have admitted the undetected intrusion of viruses and malicious software.

There were also weak disaster recovery processes in place and source code for the client application (only) could only be inspected after signing a non-disclosure agreement. In other words highly unsatisfactory and if anyone seriously challenged  the results it would be nigh on impossible for the Estonian election commission to prove that no tampering had occurred.

Read the full OSCE report [PDF]


Technology is fallible – Questions over Estonia’s e-voting

Just as the terrible problems with the nuclear power stations in Japan are showing us, technology is fallible. That’s a fact, so we must choose carefully where we apply technology, in the full knowledge that it will go wrong at some point. In my view the risks outweigh the potential positives in numerous applications of technology, including electronic voting. The expense of these systems along with the risk that an election result can be tampered with, or appear to be altered, without a verifiable way of proving either what has happened, are too great a risk for any democracy.

This was highlighted a few weeks ago when serious problems emerged with Estonia’s electronic voting system, which I have questioned previously. Reports mention an e-voting supplier being fined for problems with the system and questions over the results as a student identifies a flaw in the system.

The ‘father’ of Estonia’s e-voting system, admitting it was imperfect, sprang to its defence. The Estonian supreme court rejected the student’s challenge to the results on the basis that the flaws were hypothetical and hadn’t been proven to have been used.

This is exactly the kind of doubt and questioning in an election’s legitimacy that e-voting problems enable. A costly exercise in reducing people’s faith in their electoral system.

Paper Vote Canada has more on this story.


London confirms choice to use e-counting again

Given the signs, I’m not hugely surprised that London Elects have decided to go with e-counting again for 2010. It’s only likely to cost the taxpayer about £1.5 million more than doing it manually… and that doesn’t seem to bother Boris, but it bothers me. The DRS release claims that, if the GLA agree to use them in 2016 too, then they will be £0.2m cheaper per election than manual counting. But based on my review of the GLA figures for manual counting, they were seriously inflated to make e-counting look more attractive (and the Electoral Commission concurred). So I challenge DRS’ claim to cost-effectiveness.

As is often the case, rather than recognising the fundamental difficulties with e-counting (or e-voting), the GLA have decided that last time’s problems were because of the supplier they chose. So they’ve dumped Indra for a joint venture between DRS Data Services and Electoral Reform Services. (Disclosure: I’m a member of the Electoral Reform Society who own Electoral Reform Services.)

These were the same two suppliers involved in running the last Scottish Parliamentary elections, which also experienced significant problems as observed by ORG. Given his background and the sensitivity of these contracts, it is interesting that Lord (Neil) Kinnock remains on the board of DRS.

ORG will be planning to observe these elections once again. I hope they are trouble-free and improve on the experience in 2008. We’ll be watching!

Full announcement on the DRS website

e-democ / e-gov voting

Links 9-8-10

  • Some super slides (well worth reviewing in full, links below) from leading computer security experts presented at the US National Institute of Standards and Technology’s workshop in Washington DC on however overseas citizens should vote. Choice quotes below. (via Ian Brown and FIPR)

Prof. David Wagner (UC Berkeley):

It is not technologically feasible today to make Internet voting safe against attack.
Operating an Internet voting system safely requires expertise and money way beyond what election officials are likely to have.
There is no known way to audit Internet voting. UOCAVA votes might fall “under a cloud of suspicion.”

Prof. Ron Rivest (MIT):

Remote voting is trade-off between franchise and risk
The risks of “internet voting” more than negate any possible benefits from an increase in franchise
Unsupervised remote voting vulnerable to vote-selling, bribery, and coercion.
We may view internet voting as voting on a contraption consisting of a collection of […] puzzle boxes, all connected by untraceable wires to every possible adversary on the planet.

We do not currently have the technology to make internet voting secure (and may never).
We can’t make such technology appear by wishful thinking, just trying hard, making analogies with other fields, or running pilots.
It is imprudent (irresponsible?) to assume that determined effort by adversaries can’t defeat security objectives of internet voting.
“What are best practices for internet voting?” to me sounds like “Pleash jush help me inshert the key in the lock, (hic), and I’ll be on my way…”