Tag: e-voting

Categories
voting

Update on Independent report on Estonia’s e-voting

On Saturday 10th May we (the Independent Team) informed key stakeholders in Estonia that we would be reporting our findings the coming Monday. We contacted the Estonian Elections Committee, other officials and agencies as well as media. We did this impartially and openly to avoid being seen to favour any one political party or media source.

Late on Sunday 11th May we launched our website summarising the findings and supporting them with photos and videos.

On Monday 12th May we held a press conference – to which there had been an open invitation – to present our findings and answer questions from anyone who wanted to. That day a first response to our work was posted by the Estonian Electronic Voting Committee’s Facebook page, to which we responded.

On Tuesday 13th May we met privately with members of the Estonian Electronic Voting Committee (which is part of the overall Elections Committee).  There we talked through our findings and shared technical details of issues and vulnerabilities that will not be published until the current elections are over. We also assured them that we would not publish any demonstration code until after the election, and would not interact with the live voting system if they chose to proceed with using it for the European Parliamentary elections. They confirmed they would proceed with using their system. I was particularly surprised when the Electronic Voting Committee members said they could think of no circumstances in which they wouldn’t proceed with using their system.

The same day the Elections Committee published a lengthy response to The Guardian’s reporting of our findings. We responded in full here.

Since Monday we have had significant interest from a range of people in Estonia’s tech industry who we have met or corresponded with. We have also seen local and international media reporting on our findings.

Sadly, despite repeated requests, we have not been able to meet with representatives of the Estonian government nor the key Parliamentary committees with oversight on these issues. The Estonian Prime Minister and President have used the media (and social media) to dismiss our work and suggest we are working to favour one political party over another in Estonia. That simply isn’t true, such a response would appear to be a case of trying to shoot the messenger rather than hear some uncomfortable truths.

On Saturday 17th May we published the detailed technical analysis report to expand on and support the findings we had published a week earlier. The paper has also been submitted to an academic conference.

I have been pleased to see such widespread discussion of our findings. However some have sought to shut down the debate by seeking to query our independence and integrity. These claims have no truth and team members have a strong record of examining the security of e-voting systems around the world without any fear or favour for political parties of any type.

Some have suggested that Estonia is uniquely able to deliver secure online voting because of their universal ID smartcards and cyberwar protections. They would argue that no other country than Estonia has the infrastructure to use online voting. Whilst I agree that Estonia has a highly developed online infrastructure, which is incredibly exciting for e-government applications, even that isn’t enough for the uniquely difficult problem of online voting.

The debate is for Estonian citizens to have now with input from the EU and NATO where they have obligations as a member-state. If I was an Estonian I would be voting on paper but happily making use of their online services for tax, health and more.

Categories
voting

Estonia and the risks of internet voting

Originally posted on the Open Rights Group Blog.

In my capacity as an ORG Advisory Council member I’ve been working with an independent team of election observers researching the Internet voting systems used by Estonia. Why should anyone in the UK be interested in this?

Two reasons: Firstly Estonia is regularly held up as a model of e-government and e-voting that many countries, including the UK, wish to emulate. Secondly, after years of e-voting being off the UK agenda (thanks in part to ORG’s previous work in this area), the chair of the Electoral Commission recently put the idea of e-voting for British elections back in play.

Before our or any other government leaps to copy the Estonian model, our team wanted to better understand the strengths and weaknesses of the Estonian system. So several of us monitored the internet voting in operation for Estonia’s October 2013 municipal elections as official observers accredited the Estonian National Election Committee. Subsequently the team used the openly published source code and procedures for the Estonian system to build a replica in a lab environment at the University of Michigan. This enabled detailed analysis and research to be undertaken on the replica of the real system.

Despite being built on their impressive national ID smartcard infrastructure, we were able to find very significant flaws in the Estonian internet voting system, which they call “I-voting”. There were several serious problems identified:

Obsolete threat model

The Estonian system uses a security architecture that may have been adequate when the system was introduced a decade ago, but it is now dangerously out of date. Since the time the system was designed, state-level cyberattacks have become a very real threat. Recent attacks by China against U.S. companies, by the U.S. against Iran, and by the U.K. against European telecoms demonstrate the proliferation and sophistication of state-level attackers. Estonia itself suffered massive denial-of-service attacks in 2007 attributed to Russia.

Estonia’s system places extreme trust in election servers and voters’ computers — all easy targets for a foreign power. The report demonstrates multiple ways that today’s state-level attackers could exploit the Estonian system to change votes, compromise the secret ballot, disrupt elections, or cast doubt on the fairness of results.

Abundant lapses in operational security and procedures

Observation of the way the I-voting system was operated by election staff highlighted a lack of adequate procedures for both daily operations and handling anomalies. This creates opportunities for attacks and errors to occur and makes it difficult for auditors to determine whether correct actions were taken.

Close inspection of videos published by election officials reveals numerous lapses in the most basic security practices. They appear to show the workers downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing election software for distribution to the public on insecure personal computers, among other examples. These actions indicate a dangerously inadequate level of professionalism in security administration that leaves the whole system open to attack and manipulation.

Serious vulnerabilities demonstrated

The authors reproduced the e-voting system in their laboratory using the published source code and client software. They then attempted to attack it, playing the role of a foreign power (or a well resourced candidate willing to pay a criminal organization to ensure they win). The team found that the Estonian I-voting system is vulnerable to a range of attacks that could undetectably alter election results. They constructed detailed demonstration attacks for two such examples:

Server-side attacks: Malware that rigs the vote count

The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.

The researchers demonstrated that they can infect the counting server with vote-stealing malware. In this attack, a state-level attacker or a dishonest election official inserts a stealthy form of infectious code onto a computer used in the pre-election setup process. The infection spreads via software DVDs used to install the operating systems on all the election servers. This code ensures that the basic checks used to ensure the integrity of the software would still appear to pass, despite the software having been modified. The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.

Client-side attacks: A bot that overwrites your vote

Client-side attacks have been proposed in the past, but the team found that constructing fully functional client-side attacks is alarmingly straightforward. Although Estonia uses many security safeguards — including encrypted web sites, security chips in national ID cards, and smartphone-based vote confirmation — all of these checks can be bypassed by a realistic attacker.

A voter’s home or work computer is attacked by infecting it with malware, as millions of computers are every year. This malicious software could be delivered by pre-existing infections (botnets) or by compromising the voting client before it is downloaded by voters by exploiting operational security lapses. The attacker’s  software would be able to observe a citizen voting then could silently steal the PIN codes required to use the voter’s ID card. The next time the citizen inserts the ID card — say, to access their bank account — the malware can use the stolen PINs to cast a replacement vote for the attacker’s preferred candidate. This attack could be replicated across tens of thousands of computers. Preparation could being well in advance of the election starting by using a replica of the I-voting system, as the team did for their tests.

Insufficient transparency to establish trust in election outcomes

Despite positive gestures towards transparency — such as releasing portions of the software as open source and posting many hours of videos documenting the configuration and tabulation steps — Estonia’s system fails to provide compelling proof that election outcomes are correct. Critical steps occur off camera, and potentially vulnerable portions of the software are not available for public inspection. (Though making source code openly available is not sufficient to protect the software from flaws and attacks.) Many potential vulnerabilities and forms of attack would be impossible to detect based on the information provided to the public. So while the researchers applaud attempts at transparency, ultimately too much of how the I-voting system operates is invisible for it to be able to convince skeptical voters or candidates in the outcomes.

To illustrate this point, the team filmed themselves carrying out exactly the same procedural steps that real election officials show innearly 24 hours of videos from the 2013 elections. However, due to the presence of malware injected by the team before the recordings started, their count produces a dishonest result.

Recommendation: E-voting should be withdrawn

After studying other e-voting systems around the world, the team was particularly alarmed by the Estonian I-voting system. It has serious design weaknesses that are exacerbated by weak operational management. It has been built on assumptions which are outdated and do not reflect the contemporary reality of state-level attacks and sophisticated cybercrime. These problems stem from fundamental architectural problems that cannot be resolved with quick fixes or interim steps.

While we believe e-government has many promising uses, the Estonian I-voting system carries grave risks — elections could be stolen, disrupted, or cast into disrepute. In light of these problems, our urgent recommendation is that to maintain the integrity of the Estonian electoral process, use of the Estonian I-voting system should be immediately discontinued.

Our work shows that despite a decade of experience and advanced e-government infrastructure Estonia are unable to provide a secure e-voting system. So we believe other countries including the UK should learn from this that voting is a uniquely challenging system to provide online whilst maintaining the fundamental requirements of fair elections: secrecy of the vote, security and accuracy. The significant costs of attempting to build such a system would be better directed at other forms of e-government which can provide greater and more reliable benefits for citizens without risking the sanctity of elections.

Read and watch more about this work at https://estoniaevoting.org

 

 

Categories
voting

Press Release: Independent Team finds serious vulnerabilities in Estonian Internet Voting System

Ahead of European Parliamentary elections an International team of independent experts identifies major risks in the security of Estonia’s Internet voting system and recommends its immediate withdrawalEstonia’s Internet voting system has such serious security vulnerabilities that an international team of independent experts recommends that it should be immediately discontinued.The team members, including Jason Kitcat from the UK’s Open Rights Group, were officially accredited to observe the Estonian Internet voting system during the October 2013 municipal elections. These observations — and subsequent security analysis and laboratory testing — revealed a series of alarming problems.  Operational security is lax and inconsistent, transparency measures are insufficient to prove an honest count, and the software design is highly vulnerable to attack from foreign powers.

Estonia is the only country in the world that relies on Internet voting in a significant way for national elections. The system is currently used for Estonia’s national parliamentary elections, municipal elections and is planned to be used for the May 2014 European Parliamentary elections. In recent polls, 20-25% of voters cast their ballots online.

Independent security researcher Harri Hursti, who observed operations in the election data center during October 2013, said there were numerous security lapses. “We didn’t see a polished, fully documented procedural approach of maintaining the back-end systems for these online elections,” said Hursti. Videos published by election officials show the officials downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing the election software for distribution to the public on insecure personal computers.  “These computers could have easily been compromised by criminals or foreign hackers, undermining the security of the whole system” Hursti said.

Assistant Professor J. Alex Halderman from the University of Michigan, pointed to fundamental weaknesses in the I-voting system’s design.  “Estonia’s Internet voting system blindly trusts the election servers and the voters’ computers”, Halderman said.  “Either of these would be an attractive target for state-level attackers.”  Recent reports about state-sponsored hacking of American companies by China and European telecoms by the NSA demonstrate that these dangers are a reality, Halderman explained.

To experimentally confirm these risks, Halderman and his Ph.D. students recreated the Estonian “I-voting system” in their laboratory based on the published software used in 2013.  They successfully simulated multiple modes of attacks that could be carried out by a foreign power. “Although the Estonian system contains a number of security safeguards, these are insufficient to protect against the attacks we tried,” said Halderman.

In one attack, malware on the voter’s computer silently steals votes, despite the systems’ use of secure national ID cards and smartphone verification.  A second kind of attack smuggles vote-stealing software into the tabulation server that produces the final official count.  The team produced videos in which they carry out exactly the same configuration steps as election officials — but with the system under attack by a simulated state-level adversary.  Everything appears normal, but the final count produces a dishonest result.

“There is no doubt that the Estonian I-voting system is vulnerable to state-level attackers, and it could also be compromised by dishonest election officials,” said Halderman.  These attackers could change votes, compromise the secret ballot, disrupt voting, or cast doubt on the legitimacy of the election process.

The team recently arrived at these results and were so alarmed that they decided to urgently make their findings public ahead of the upcoming European elections, explained Jason Kitcat from the Open Rights Group.  “I was shocked at what we found,” explained Kitcat.  “We never thought we’d see as many problems and vulnerabilities as we did. We feel duty-bound to make the public aware of those problems.”

While some of the problems can be corrected in the short term through changes to the system, others stem from fundamental weaknesses that cannot be fixed.  With the growing risk of state-level cyberattacks, the team unanimously recommends discontinuing Internet voting until there are fundamental advances in computer security.

“With today’s security technology, no country in the world is able to provide a secure Internet voting system,” said Hursti.  “I would recommend that Estonia return to a paper ballot only system.”

Maggie MacAlpine, a Post-Election Audit Advisor said, “While Estonia has an excellent e-government system, which they should continue to develop, they should take the Internet voting element of that off-line. Estonia has a well organized paper voting system which they should revert back to.”

The full report and videos explaining the key findings will be published at https://estoniaevoting.org

NOTES FOR EDITORS

For queries contact estoniaevoting@umich.edu or Jason Kitcat at +44 7956 886 508.

The report authors are:

J. Alex Halderman, University of Michigan*
Harri Hursti, Independent Security Researcher*
Jason Kitcat, Open Rights Group*
Maggie MacAlpine, Post-Election Audit Advisor*
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan

* Authors who acted as election observers for 2013 Estonian local elections

ENDS.

 

Categories
voting

Flaws found in Estonian internet voting system – PRESS CONFERENCE by independent team on this Monday 12th May in Tallinn, Estonia

PRESS CONFERENCE 12th May 2014 11:00am — Hotel Metropol, Tallinn

International Team of Independent Election Observers to deliver report on Estonian Internet Voting System

TALLINN, Estonia — An international team of independent experts will deliver their findings on the security of the Estonian E-Voting System this Monday.

This team of renowned experts on computer security and voting systems observed the use of Internet Voting in the 2013 Estonian municipal elections. Ahead of the 2014 European Elections, which plan to use the same internet voting system in Estonia, the International experts will introduce a report in which they explain their observations from 2013 and the results of their security analysis. Their analysis has identified serious flaws in the systems and processes used in Estonian internet voting.

The entire team will be at the press conference and available for interview afterwards to present and discuss their findings.

NOTES FOR EDITORS

For queries contact Jason Kitcat on jason@jasonkitcat.com or +44 7956 886 508

* The Press conference will be in the Hotel Metropol, Roseni 13, 10111 Tallinn, Estonia at 11am on Monday 12th May 2014. The press conference will be in English.

* The report and associated information will be later available from https://estoniaevoting.org

* The team who produced the report and who will be present at the press conference are:
J. Alex Halderman, University of Michigan
Harri Hursti, Independent Security Researcher
Jason Kitcat, Open Rights Group
Maggie MacAlpine, Post-Election Audit Advisor
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan

ENDS.

Categories
notes from JK voting

Trip report – Estonia on e-voting, transport and politics

Meeting the Mayor of Tallinn
Meeting the Mayor of Tallinn, Mr Savisaar

At the beginning of February I spent three days in Estonia at the invitation and expense of Mr Edgar Savisaar, the Centre Party Mayor of Tallinn (and Estonia’s first post-Soviet prime minister). My visit had three main aims:

  1. To present some public lectures on my views and experiences opposing electronic voting. Estonia is the only country in the world to allow all citizens to vote by Internet in their Parliamentary elections.
  2. To learn more about Tallinn’s new policy of free public transport for citizens, which had launched on 1st January 2013.
  3. To explore how Estonia does local government and what I could learn from that, to build fruitful links between our universities and partners to support future investment and EU funding bids.

I spent most of the first day with Mr Savisaar including a formal lunch reception with a range of MPs, council officials and academics. Most of them shared deep concerns about the country’s internet voting system. This concern is a minority view in Estonia, especially in the Parliament. I have not had the opportunity to study the Estonian system in detail so cannot comment on specifics, but my friend and fellow e-voting campaigner Barbara Simons has posted her critical thoughts following her own visit and analysis of other reports.

My long held view against e-voting can be summarised as that the very significant risks introduced by the technology are not worth it, and the huge costs do not justify increasing electoral risks, as there are no other obvious benefits. Like the rest of Europe, Estonia has had to trim its national spending, so I found many Estonians agreeing that there were other priorities the money invested in e-voting could be better spent on.

Giving a lecture on e-voting in Tallinn
Giving a lecture on e-voting in Tallinn

Following meetings with officials detailing my experiences as ORG’s e-voting campaigns coordinator, plus sharing some ideas and contacts on how to further the Estonian campaign against e-voting, we went on to my first public lecture. This very well attended event was live translated into Estonian and Russian (there is a significant Russian-speaking population) and was recorded for a local TV station. You can see clips of the event and a follow-up interview here. Footage of the meeting earlier in the day is here and here. (I don’t know if the full video of my lecture will be released online, but it was an evolution of my 2007 presentation of ORG’s election observation which can be watched here)

The next day I had an early morning meeting with Ivar Tallo, a former MP and e-government lecturer, who is a well known supporter of Estonia’s e-voting. We had a good conversation but didn’t settle our differences for and against e-voting! Then with Priit Toobal MP, one of Mr Savisaar’s assistants and a translator we went on a small tour of the country visiting Paide city (right in the centre of the country) and Parnu (a popular coastal summer resort town). I met MPs and councillors in each place whilst also presenting a shorter version of my e-voting lecture.

All the meetings and conservations gave me some interesting insights into Estonia’s advanced e-government infrastructure, the development challenges as population is drawn inexorably towards the capital city of Tallinn along with views and experiences of Tallinn’s free public transport. I learnt from Vice-Mayor Taavi Aas that in January bus usage had jumped about 15% whilst traffic at key central junctions in Tallinn had dropped 20%. Early days yet, but interesting. I also completely ran out of brochures for the Universities of Sussex and Brighton.

With Taavi Aas, Vice-Mayor of Tallinn responsible for transport
With Taavi Aas, Vice-Mayor of Tallinn responsible for transport

I doubt many use it, but I was impressed that the Estonian infrastructure allows citizens to see who (in and out of government) has accessed their identity information with a full log and lets citizens control who can view their online medical data. Citizen-centric data management seems to be an important step towards our digital future. I would urge more investment there than in online voting methods!

I was also interested to learn that local government in Estonia is primarily funded by a share of income tax. So every 1,000 people moving into Tallinn bring in an addition €1m/year from that share. There is also some form of land value tax in use too. Compared to the broken taxation system councils in England depend on, a local share of income tax looks very simple and clear to understand indeed!

On the final day, before leaving, I had a chance to explore the streets of Tallinn a bit more. It’s a small city centre with a fascinating history involving Swedes, Germans, Russians and Dutch colonialism. Also lots of free wifi which doesn’t require frustrating registration forms, just a simple ‘I agree to T&Cs’ button to get going.

Of course one can never fully understand all the nuances in a short visit. But Brighton & Hove has now established some strong links with Tallinn and Estonia for our universities and councils to pursue. We are already looking at some joint EU bids between our councils. Meanwhile the campaign against e-voting continues.

I’d like to thank everyone who helped make my visit go so smoothly including Mr Edgar Savisaar, his assistants especially Oksana Jalakas, Priit Toobal MP, Kadri Simson MP, Taavi Aas, Allan Alaküla, Elena Sapp and many more.

View on part of Tallinn’s Old Town
Categories
voting

OSCE flag concerns with Estonian e-voting system

Emilis Dambauskas writes:

I have noticed that OSCE published final assessment report for Estonian Parliamentary Elections that happened on 6th March 2011:

http://www.osce.org/odihr/elections/estonia/75382

Executive summary states:

Voters could cast their ballots via the Internet during the advance  voting period from 24 February to 2 March. Despite concerns raised by some interlocutors, the OSCE/ODIHR EAM in general found widespread trust in the conduct of the Internet voting by the National Electoral Committee (NEC). However, there is scope for further improvement of the legal framework, oversight and accountability, and some technical aspects of the Internet voting system.

However there are some details which make the situation smell strangely:

(page 11): During the counting, one vote was determined invalid by the vote counting application since it was cast for a candidate who was not on the list in the corresponding constituency. The project manager could not explain how this occurred – the investigation was still ongoing at the time of issuing the report.

A student demonstrated that the client-side voting application “was flawed and could make it possible for a virus to block a vote without the voter knowing that any interference had occurred”:
http://news.err.ee/Politics/bbb598aa-586b-4981-9f7e-88273b5a25c0

The report mentions various other questionable practices by the i-voting vendor (called “project manager”). I want to re-read the report, but it seems like Estonians may have privatized their elections…

Indeed privatisation is another reason to resist the introduction of e-voting, as it is much harder to scrutinise the processes and systems used. Another quote from the report rings alarm bells for me:

The vendor, Cybernetica AS, handed over the internet voting software to the NEC in December 2010. The OSCE/ODIHR [election monitoring mission] was informed that the [privately contracted] project manager was able to update the software of the Internet voting system until right before the elections started, and without a formal consent of the NEC. This was done without any formal procedure or documented acceptance of the software source code by the NEC, which limited the information on which version of the software was ultimately used.

More concerns:

As in previous elections, and despite the recommendation made by the OSCE/ODIHR in 2007, the time of casting a vote was recorded in a log file by the vote storage server along with the personal identification code of the voter. This could potentially allow checking whether the voter re-cast his/her Internet vote, thus circumventing the safeguards in place to protect the freedom of the vote.

…

The project manager accessed the servers for daily data maintenance and backup breaking the security seals and using a data storage medium employed also for other purposes. This practice could potentially have admitted the undetected intrusion of viruses and malicious software.

There were also weak disaster recovery processes in place and source code for the client application (only) could only be inspected after signing a non-disclosure agreement. In other words highly unsatisfactory and if anyone seriously challenged  the results it would be nigh on impossible for the Estonian election commission to prove that no tampering had occurred.

Read the full OSCE report [PDF]

Categories
voting

Technology is fallible – Questions over Estonia’s e-voting

Just as the terrible problems with the nuclear power stations in Japan are showing us, technology is fallible. That’s a fact, so we must choose carefully where we apply technology, in the full knowledge that it will go wrong at some point. In my view the risks outweigh the potential positives in numerous applications of technology, including electronic voting. The expense of these systems along with the risk that an election result can be tampered with, or appear to be altered, without a verifiable way of proving either what has happened, are too great a risk for any democracy.

This was highlighted a few weeks ago when serious problems emerged with Estonia’s electronic voting system, which I have questioned previously. Reports mention an e-voting supplier being fined for problems with the system and questions over the results as a student identifies a flaw in the system.

The ‘father’ of Estonia’s e-voting system, admitting it was imperfect, sprang to its defence. The Estonian supreme court rejected the student’s challenge to the results on the basis that the flaws were hypothetical and hadn’t been proven to have been used.

This is exactly the kind of doubt and questioning in an election’s legitimacy that e-voting problems enable. A costly exercise in reducing people’s faith in their electoral system.

Paper Vote Canada has more on this story.

Categories
e-democ / e-gov voting

Links 9-8-10

  • Some super slides (well worth reviewing in full, links below) from leading computer security experts presented at the US National Institute of Standards and Technology’s workshop in Washington DC on however overseas citizens should vote. Choice quotes below. (via Ian Brown and FIPR)

Prof. David Wagner (UC Berkeley):
http://csrc.nist.gov/groups/ST/UOCAVA/2010/Presentations/WAGNER_UOCAVA2010.pdf

It is not technologically feasible today to make Internet voting safe against attack.
Operating an Internet voting system safely requires expertise and money way beyond what election officials are likely to have.
There is no known way to audit Internet voting. UOCAVA votes might fall “under a cloud of suspicion.”

Prof. Ron Rivest (MIT):
http://csrc.nist.gov/groups/ST/UOCAVA/2010/Presentations/RIVEST_2010-08-05-uocava.pdf

Remote voting is trade-off between franchise and risk
The risks of “internet voting” more than negate any possible benefits from an increase in franchise
Unsupervised remote voting vulnerable to vote-selling, bribery, and coercion.
We may view internet voting as voting on a contraption consisting of a collection of […] puzzle boxes, all connected by untraceable wires to every possible adversary on the planet.

We do not currently have the technology to make internet voting secure (and may never).
We can’t make such technology appear by wishful thinking, just trying hard, making analogies with other fields, or running pilots.
It is imprudent (irresponsible?) to assume that determined effort by adversaries can’t defeat security objectives of internet voting.
“What are best practices for internet voting?” to me sounds like “Pleash jush help me inshert the key in the lock, (hic), and I’ll be on my way…”

Categories
voting

Answering eDemocracyBlog’s case in favour of e-voting

eDemocracyBlog has recently put forward some arguments in favour of e-voting in response to the Hansard Society’s debate on the subject.

The blog’s author (whom I can’t identify) takes issue with a number of my views which I aim to defend here.

I tend to argue from first principles which requirements any electoral system should meet. These are that elections should be secure, verifiable and anonymous. eDemocracyBlog argues that because not all existing electoral systems, such as postal voting, meets these then my views on e-voting are flawed. I don’t agree at all.

I did actually mention at the Hansard event my concerns about postal voting. But when asked to debate e-voting I focussed on the challenges there, that isn’t to say that existing electoral arrangements are perfect — they aren’t. But just because that is the case in no way makes the case for e-voting. It just further re-inforces our need to focus on fixing the current setup.

The eDemocracyBlog writes:


Related to the security point was Kitcat’s comment that delivering PINs to anyone wanting to vote electronically would create a further threat to security. Yet banks generally seem able to handle the process.

Kitcat also said eVoting could enable “ballot stuffing on a massive scale” which the need to photocopy and complete postal ballots makes more difficult. But for a would-be fraudster it should be far harder to get hold of a large number of PINs than it is to get hold of a blank ballot paper and photocopy it.

Banking is a completely different process to voting: It isn’t anonymous, it’s easy to verify because you receive monthly statements and losses are just a cost of doing business – not the outcome of a binding political election where the stakes are much higher.

eDemocracyBlog is apparently unaware that paper ballots have security marks such as stamps, or watermarks which means you cannot photocopy them. This is why fraudsters try to collect postal ballots, because they can’t produce fresh ballots themselves.

Any smart hacker isn’t going to try to break the system by intercepting PINs (for example) in the postal system. They will crack the computer systems centrally and manipulate the authorisation credentials there or just directly manipulate the results. It’s much easier to change the result on one central computer then thousands of postal ballots, for example. We’ve seen electronic voting results cast in serious doubt in the US, Canada, Japan and many more countries.

eDemocracyBlog continues:

As for the possibility of somehow hacking into the system and creating false voting records, it may be possible that details of voters can be held separately from the details of votes, and then matched again during the counting process with each voter told how their vote was registered so that they can report if it was changed without their permission.

If such a process was enabled the vote would no longer be secret, breaching the Human Rights Act (plus our European and UN human rights committments). This would leave people open to abuse, intimidation and family voting. This is not theoretical – it happens with postal voting.

I think Andy Williamson made a telling point that wasn’t rebutted when he noted that banks manage to verify cash machine transactions without ever knowing the cardholder’s PIN.

As I understand it they don’t verify the transactions. They just verify the cardholder details via the PIN. So it’s not the same and it’s very much not anonymous (wave to the camera in the ATM!)

It is also worth pointing out that the current paper-based balloting system is not anonymous either, so again this would seem to be a case of making demands of eVoting which are not equally applied to the existing system.

Only in the UK is our paper voting system not anonymous. In all other modern democracies it is. And citizens of those countries are appalled when they hear of our antiquated system which is a holdover of the Australian system from the 1860s. The Australians switched to anonymous votes before we even adopted the secret (but numbered) paper ballot here in the UK.

Another question is whether any system can be both anonymous and verifiable anyway? If it is genuinely anonymous then who is to tell whether any ballot was cast by a legitimate voter rather than, say, dumped into the ballot box by a corrupt council employee before it is sealed?

Ah, it seems eDemocracyBlog is beginning to come to terms with the difficulty of the problem. It is very difficult to build a digital system which is anonymous and verifiable – in fact I believe it’s not possible with current technology. With paper it is possible, if the paper has security marks so you can trust its source and prevent ballot stuffing.

eDemocracyBlog then goes on to attack the Electoral Commission for failing to set up a certification process for e-voting systems. But it would be up to the Government to empower the Commission to do such a thing, and to provide funds for it to be conducted. It’s my view that certification, while necessary if technology is to be used, doesn’t resolve many of the serious problems with e-voting.

Later on the Commission are again criticised by eDemocracyBlog for failing to develop a strategy for voting modernisation. But this is not a task for the Commission – it is for government to set out their view, try to pass legislation and consult the Commission on the approach.

People do not need to know how something works, or even be entirely confident in its security and privacy policies, in order to use it in their millions. I could perhaps mention Facebook at this point.

This was the same argument made by VoteHere’s Jim Adler against me in the Oxford Union debate on e-voting. Jim argued that people don’t need to understand how a plane works to fly in it. But this misses the fundamental point. With a plane, or Facebook, the results are self-evident. You fly to your destination or your post on someone’s profile appears. With a vote, because it is secret, how do you know it was accurately counted as you intended?

With paper and a public count you are fairly certain, thanks to the known properties of pen and paper, that the outcome will be valid. With an e-vote you can’t have the same confidence.

eDemocracyBlog continues defending e-voting by suggesting the costs will be lower when used on a greater scale than for just the pilots. No doubt, there were one-off costs for the pilots. However I know that several of the providers swallowed significant losses for the pilots just so that they could stay in the market, hoping to win a juicy national contract.

Furthermore the contracts were agreed centrally by the government, not by councils as eDemocracyBlog suggests. So, especially when suppliers provided for several areas, there could have been economies. £58m for weekend voting across our country would be a fraction of the costs e-voting would involve.

There is no need for e-voting to happen. Certainly in the current times of tight budgets, e-voting is extremely unlikely to happen. However I’m sure that it won’t be too long before the spectre arises once more, just because people seem to like the idea of applying technology to everything they can. Thankfully more and more people are becoming aware of the great risks e-voting presents for very limited benefits.

Categories
voting

Why can’t I vote at my ATM? Hansard Society Debate

This evening the Hansard Society hosted a panel debate in Portcullis House, Westminster with the title “Why can’t I vote at my ATM? – the practicalities of the ballot box.”

I along with Electoral Commission Chair, Jenny Watson and Tom Watson Harris MP made up the panel. The audience was filled with a wide variety of interesting people including current and former Electoral Commission staff, civil servants, Lords and activists.

While we didn’t all agree on the reasoning, there was a fairly general consensus that electronic voting shouldn’t be pursued at the moment. There was lots of interesting debate on issues of access and turnout. I hope the society will put online a podcast or summary of the event in some form. I post below my opening speech for the event.

——–

Thank you for inviting me here to participate this evening.

I come to this issue as a programmer, as someone who has observed elections for the Open Rights Group and who, as a local councillor, has had a very personal interest in elections.

As an observer the ultimate compliment one can pay an election is to say that it was ‘free and fair’.

What does an election process need to do to be considered free and fair?

There are three key properties that ALL must be met. An election must be:

  • Secure
  • Verifiable
  • Anonymous

By secure we mean that the results cannot be changed, that only those entitled to vote actually do so and people can only vote one time.

Verifiable means that candidates, agents, observers and voters can check the result and have confidence that the result reflects the will of the people. Voters need to be sure that their intention was accurately recorded and counted.

Finally to prevent coercion, vote selling and bribery voters absolutely need to be secure in the knowledge that their vote is secret and that people cannot know how they voted. I am aware that the UK currently doesn’t have a completely secret ballot, we should, but that’s a debate for another day.

  • Secure
  • Verifiable
  • Anonymous

A properly run paper-based election can meet those three requirements.

However with current technology electronic voting cannot meet those three principles. It just isn’t technically possible to have an electronic system which is secure and anonymous whilst also being verifiable.

When the Open Rights Group observed electronic elections in the UK we were unable to declare confidence in the results, because we just couldn’t properly verify the counts at all, it was hidden behind the technology.

Online banking is a completely different problem, the transactions are not secret, we can see them in our statements and merchants collect lots of personal information about us to push through their anti-fraud systems. Technology is great for so many things, but not voting.

If you’ve heard the complaints from the music and movie industries over recent years, then you’ll know that computers are good at copying. With electronic voting we risk undetectable ballot stuffing on a massive scale.

Currently the very nature of paper – that you need a vehicle to move around lots of it, that it’s logistically challenging to deal with thousands of ballots – limits fraud and increases the chance of fraudsters being caught. With electronic votes the fraud can happen in a computer, where none of us can see inside, with millions of votes changed or copied whilst controlled by someone on the other side of the world.

I’ll save more details of the technical problems with electronic voting and counting for the questions, if people are interested. But there is a broad consensus in the computing world that these technologies should not be used. The Association for Computing Machinery and the British Computer Society as well as scores of academics have voiced their opposition. So far e-voting has been cancelled in Ireland, Netherlands, Germany, Italy and the province of Quebec. There have been serious problems found with e-voting systems in India, Japan, France, Belgium and of course the United States.

I might add that these systems are hugely expensive, costing many times more than traditional paper-based elections. In a 2003 e-voting trial in Sheffield, for example, the cost was £70 per e-vote cast versus £1 per paper vote. And on average turnout still declined during the UK’s electronic voting pilots between 2000 and 2007.

On turnout, we need to be very careful. Much of the over £50 million spent on UK pilots in the last 10 years was based on blind faith that online voting would boost turnout. It didn’t, simply because ease of voting is not the main factor for why people don’t vote. Indeed there are studies showing that people who live furthest from their polling station are most likely to vote!

People choose not to vote because they feel all politicians are the same, that their vote doesn’t count or they don’t know enough about the issues to vote. That’s a challenge for the political system to address, one which electoral reform could help with as there’s data clearly showing higher turnouts in countries with fairer electoral systems.

That being said, politics aside, what should we do about our electoral processes? We absolutely and urgently need individual voter registration and that could be tied in with an online electoral roll. That’s a place where technology could help voters, election administrators and party activists.

We need to clamp down on postal voting, it’s the source of most allegations of fraud. It will need to still be available, but in a much more controlled and secure manner.

We need to review polling day. I know the Electoral Commission have done quite a bit of interesting work on this. Moving elections to the weekends, perhaps all weekend, is one option but the consultation responses to this were, I understand, rather mixed. What we could do is declare a public holiday on election day, we could also consider offering, before polling day, early voting in town halls.

Finally, I think counts need to stay open, be manual, paper based and easily scrutinised. It’s only by watching piles of ballots add up, by observing them being sorted and checked, that we can have confidence in the result. What could help would be more standardised procedures for the counts. This would assist with training of all involved – at the moment every count across the country can be done in a different way. Let’s not stamp out local innovation, but let’s make sure there are minimum standards so we can have confidence in a modern, paper-based electoral system.

In closing, I believe electronic voting & counting are not the way forward, let’s update our existing electoral system whilst keeping it secure, verifiable and anonymous. The real challenge for engagement and turnout lies with our political culture and the fairness of our voting systems, not election administration.