Category: electronic voting

Set Up a Secure Electronic Voting System for the Canadian House of Commons, Recommends Procedure and House Affairs Report

I’m going to preface this with a plea: if an electronic voting (Internet voting) system proceeds, please involve computer security, voting system, voting technology, user experience, and web design experts from inside and outside of the government.

Also, for any journalist reporting on this: it does not mean that we could use Internet voting in a general election.  Parliamentary votes are not anonymous and not secret.  Parliamentarians vote by literally standing up in front of everyone else.  It’s a public vote.

I will also mention that in 2016 the ERRE committee already recommended, and in 2017 the government accepted, that there should be no Internet voting in general elections.

In the Parliamentary context, if they wanted to make this simple, they could just have a voice vote over videoconference (one by one, unless you want vocal chaos), or have people hold up their hands one-by-one (with alternatives for people with different abilities), or even have people hold up cards on videoconference that say “Yea” or “Nay”.  It’s nothing like an anonymous secret ballot general election.

Committee Recommendation

On May 15, 2020 the Canadian House of Commons Standing Committee on Procedure and House Affairs (“PROC”) released its fifth report of this session: Parliamentary Duties and the COVID-19 Pandemic.  I will focus only on section Discussion – A. Observations and recommendations – ii. Legal and procedural matters – (e) Voting.

Committee recommendations are not binding on the Government; the course of action will depend on the Government’s response.

The Committee therefore recommends:

That the House of Commons set up a secure electronic voting system for conducting votes in virtual sittings as soon as possible in order to guarantee the right of members to vote safely in the event of a pandemic or any other exceptional circumstances threatening their safety and/or that of their families and communities.

Par conséquent, le Comité recommande :

Que la Chambre des communes mette sur pied un système électronique de vote sécurisé pour la tenue des votes dans le cadre des séances virtuelles, et ce, aussitôt que possible, afin de garantir le droit des députés à voter en toute sécurité en cas de pandémie ou dans toute autre circonstance exceptionnelle menaçant leur sécurité et/ou celle de leurs proches et de leurs communautés.

Note that these procedure changes are intended to be temporary.

(b) Temporary nature of procedural changes

Witnesses appearing before the Committee have been unanimous in their viewpoint that any changes made to the procedures and practices of the House of Commons should be temporary and made in response to the challenges of the COVID-19 outbreak.[85]

[85] For example, see House of Commons, Standing Committee on Procedure and House Affairs, Evidence, 1st Session, 43rd Parliament, Meeting 11, 23 April 2020, 1240 (Emmett Macfarlane, University of Waterloo); and [Hon. Anthony Rota, Speaker of the House of Commons], 1120. [original footnote link: [85]]

UPDATE – Committee Tasked with Additional Remote Voting Report

Following the submission of the recommendations, the Government has tasked the committee with producing a report on how to enact remote voting by June 23, 2020.

Considerations for Remote and Internet Voting

See the end of this post for the current process of Putting the Question, as it is called.  I will walk through each of the voting scenarios as it applies to remote presence and then Internet voting.  The basic consideration is that anonymous or mass voting (simultaneous shouting) is not possible online.

Speaker puts the question.

  • No dissenting voice – seems like this could be done by videoconference as long as everyone is present and the technology is working
  • Dissenting voice – Voice division – Since this is literally all of the members shouting at once, I don’t see how this could be done by videoconference.
  • Dissenting voice – Members call: “On division” – I can’t actually figure out how this works.  I think this is a way to anonymously register dissent concerning a voice vote – if so, there is no way to reproduce this feature in a simple online system.
  • Recorded division – All members in favour rise as their places and their names are called, then all members opposed rise in their places and their names are called – this could easily be done on videoconference as long as everyone is present and the technology is working.  Maybe not by having them stand, but by having some visual or text signal, e.g. they could literally raise their hand or (much less preferably) make some other indication in the chat channel.
    • A recorded division may be conducted in one of two ways: as a party vote or as a row-by-row vote. Generally, a recorded division on an item of government business is conducted as a party vote, and a recorded division on an item of Private Members’ Business is conducted as a row-by-row vote.  (i.e. this is the same procedure, just with people called in a different order depending on whether it is a party vote or a row-by-row vote.)

So I’m not actually convinced you need Internet voting.  Except for voice division, you could just call on people one by one over videoconference the same way we already do when they are physically present in the House.

UPDATE 2020-06-02: There are additional procedure considerations when conducting remote voting.  For example, I don’t know of any way to challenge the results of a division once the Clerk has tallied the votes.  In the UK, they gave the Speaker the authority to re-run a remote division if necessary, if issues were detected.

The Speaker has the authority to call a revote:

If problems in the conduct of a remote division which might have affected the result are reported after the result is announced, the Speaker may declare the division to be null and void and make arrangements for it to be re-run.

END UPDATE

I’m not sure what the driver for introducing electronic voting (Internet voting) would be, other than the hope that it would be faster than calling on people over videoconference.  It means a big and rapid investment in authentication infrastructure, web infrastructure, and software design.

The UK implementation of “remote voting” built on an entire pre-existing infrastructure, was developed by a dedicated UK Parliamentary Digital Service, and still encountered challenges.  I’m not sure that Canada has the same technology infrastructure in place, and we definitely don’t have a Canadian Parliamentary Digital Service.

Hidden inside that single word “secure” in the Procedure Committee (PROC) recommendation is a whole world of technology complexity.

Need for a Separate Report and Modern Software Development Practices

There really needs to be a separate, dedicated, technology-focused report just on electronic voting (Internet voting) for the House of Commons that gives more specific guidance including an assessment of risks and risk mitigations.

UPDATE 2020-05-27: The committee has been called upon to produce a report on how to enact remote voting by June 23, 2020.  See my blog post How to enact remote voting for the Canadian House of Commons for more information. END UPDATE

As I indicated in my post about the UK system, you have to consider a variety of complex issues when introducing a voting system.

Considerations for a voting system include the chain-of-custody, as multiple systems are most likely involved with the transmission and counting of the vote, concerns about auditability and concerns about security, as well as usability.

Auditability is a really challenging one.  Basically either each individual MP would have to check that their vote has been counted based on their intention, and even then, they’re no longer all standing in a room where they can see how other members voted.  Unlike counting people in a room, online it’s hard if not impossible to get a good sense of whether the vote count reflects the votes cast.

Auditability considerations are somewhat mitigated by the party system, in which votes are whipped and party whips will check to see that members voted as expected.  Auditability is an even greater concern in the case of a free vote.

Usability is a key consideration for any new interface.  It only took a day for some UK members to vote the opposite way from what they intended.

Security is also a challenging one given that computers can lie, with customized malware capable of showing one result (e.g. a Yea vote) on screen and sending another (e.g. a Nay vote) to the voting software.  In that light, it’s worth mentioning that every month there is a Patch Tuesday, with May’s software updates including both Microsoft and Adobe releasing patches for vulnerabilities (“A remote attacker could exploit some of these vulnerabilities to take control of an affected system.”)

There is also a larger question, deeply related to human intentionality, about the physical and psychological differences between literally standing to be counted versus tapping a square on a screen.

The House would do well to draw upon the Government’s existing guidance for modern software development, including the Digital Standards.  The Standards surface a number of key approaches that help mitigate the risks of software development, including:

  • Design with users
    Research with users to understand their needs and the problems we want to solve. Conduct ongoing testing with users to guide design and development.
  • Iterate and improve frequently
    Develop services using agile, iterative and user-centred methods. Continuously improve in response to user needs. Try new things, start small and scale up.
  • Work in the open by default
    Share evidence, research and decision making openly. Make all non-sensitive data, information, and new code developed in delivery of services open to the outside world for sharing and reuse under an open licence.
  • Address security and privacy risks
  • Empower staff to deliver better services
    Make sure that staff have access to the tools, training and technologies they need. Empower the team to make decisions throughout the design, build and operation of the service.
  • Collaborate widely
    Create multidisciplinary teams with the range of skills needed to deliver a common goal. Share and collaborate in the open. Identify and create partnerships which help deliver value to users.

Briefs Submitted

You can see all the briefs submitted in evidence to this study.  The only ones relevant to electronic voting (Internet voting) :

  • two voting technology vendor submissions
  • a submission including expert cybersecurity considerations explaining why unlike for a general election, Internet voting is feasible for Parliamentary voting

Parliamentary voting, on the other hand, is entirely workable from a cybersecurity perspective because it differs from general elections in three crucial ways.

First, an MP’s vote is a matter of public record, which makes it possible to verify it was correctly recorded and counted. Second, the federal government has the resources to provide MPs with the necessary cybersecurity infrastructure to ensure the protection of electronic information. Third, the government has the capacity to provide MPs training on procedures necessary to ensure votes are successfully entered into the record.

  • a non-technical submission from Gregory Tardi that outlines some reasonable considerations

Bearing in mind the ever-present failings of computer-based systems, if the House decides to function in a virtual fashion, perhaps even on a temporary basis, it should gather two fundamental and vital working groups from among the staff of the House Administration:

  • a working group of legal advisors to engage in liaison with like-minded jurisdictions, especially from Commonwealth states, designed to exchange information on the best ways to ensure democracy, constitutionalism and the maintenance of parliamentary privilege, and
  • a working group of technical experts, whose principal task would be to design failsafe methods for the protection of MPs identity in their access to the system.

In order to render a virtual functioning of the House of Commons viable, the highest grade of hardware and software should be placed at the disposal of Member. Particular care should be taken in methodologies to verify each participating Member’s identity. In its preparation for the 43rd federal general election, Elections Canada worked extensively to prevent computer intrusion and fraud. That experience could be put to good use here.

If you find it surprising that only 1 of 14 briefs submitted would have independent expert technology analysis, the normal number of briefings from computer science subject matter experts submitted to a Canadian Parliamentary committee is sadly zero. Witnesses called to present at committee and briefs submitted are overwhelmingly individuals with political science or social science backgrounds.  In the 2016 Special Committee on Electoral Reform (ERRE) they called a single computer science expert in online voting, out of 196 witnesses called, even though online voting was a specific subject of consideration for the committee.

Canadian Parliamentary committees need to do better in seeking out computer science subject matter expertise.  On this topic, I will mention I have a list of over a dozen experts with Internet voting and computer security expertise.

Background – Electronic Voting Within the House

The issue of electronic voting within the House has been considered.  House of Commons Procedure and Practice, Third Edition, 2017 (referred to as Bosc and Gagnon) says basically there hasn’t been any recent action to implement electronic voting.

Chapter 12 – The Process of Debate – Decisions of the House – Calling the Vote and Announcing the Results – The Issue of Electronic Voting

The Issue of Electronic Voting

Proposals to install a system for electronic voting in the Chamber have been made over the years with a view to improving the management of the time of the House.382 In 1985, the Second Report of the McGrath Committee recommended computerized electronic voting, but the matter was not taken up by the House.383 In 1995, the Standing Committee on Procedure and House Affairs, noting that the practices of deferring several votes to the same day and time, and of applying results of votes, had “greatly speeded up the voting process”, recommended that the House not proceed at that time to a system of electronic voting.384 In 1997, the Committee briefly returned to consideration of the question of electronic voting, but did not report to the House.385 In 2003, a special committee endorsed the principle of electronic voting in the Chamber and recommended in two of its reports to the House that the necessary electronic infrastructure be installed in the Chamber during the summer of 2004.386 While the greater part of this infrastructure was installed as recommended, no further action has been taken in respect of electronic voting.

I’ve left in place the footnote links to the Procedure and Practice website, rather than pulling them all out within this blog post.

I have written a previous blog post considering this issue: Electronic voting in the Canadian House of Commons.

House of Commons Administration Report

UPDATE 2020-05-21 & 2020-06-03: Two briefs were submitted by the Speaker.

May 11, 2020 –  Virtual Chamber: A Report in Response to the Statement of the Speaker of the House on April 8, 2020 – May 7, 2020 – Version 2.0 (PDF) is available.  It has a brief section related to remote voting under the heading “Decision making” on page 18.  It’s a report from the House of Commons Administration on their considerations and analysis of what is possible; it’s not the same as a committee report.

A followup brief – May 13, 2020 – Virtual Chamber: key procedural issues (PDF).

END UPDATE

Putting the Question

As one might expect, Bosc and Gagnon provides a detailed explanation of the voting process in the House.

Chapter 12 – The Process of Debate – Decisions of the House – Putting the Question

You can read all the details there, but I have to include the marvelous Figure 12.3 Putting the Question.  Law as code, if you will.

Figure 12.3 Putting the Question
Image depicting, in a series of boxes linked by lines, the steps required for the House to make a decision on a question. It begins with debate concluding, followed by the Speaker putting the question, then listing options for voice votes or recorded divisions. If necessary, the Speaker casts a deciding vote. At the end, the Speaker declares that the motion has been adopted or rejected.

Elections Ontario recommends establishing standards and certification for elections technology

In Ontario, there are no standards in place for choosing, testing, certifying or auditing election technology, including the online voting used in Ontario municipal elections.

This is a huge gap that has opened the door to what is currently basically an unregulated process where individual municipalities choose whether or not to use Internet voting and then procure vendor-based solutions without any guidance.

It is therefore heartening to see Elections Ontario recognize this gap in its Report on Ontario’s 42nd General Election (Modernizing Ontario’s Electoral Process, June 7, 2018).  Elections Ontario makes a long recommendation which I am going to quote in full

Establish common evaluative standards and a certification process for election technology

The Chief Electoral Officer recommends that Ontario establish common evaluative standards and a certification process for technology used in the electoral process in Ontario.

Technology holds a lot of promise for the elections of the future. Increasingly, Ontarians expect that technology will be used to make voting easier, offer more choice to electors for when, where and how to vote, and find efficiencies in the electoral process. Electoral management bodies, including Elections Ontario, are increasingly turning to technology to solve logistical challenges.

In Ontario, the adoption of technology into the electoral process has been done in an ad-hoc way since the late 1980s, and has been led by municipalities. This approach made sense when voting technologies were new and there were no best practices from which to draw. It also allowed municipalities to pioneer technology and discover fit-for-purpose solutions to address their local needs.

With more than 20 years of practical experience at hand, we are at a point where we are actively learning from our past so that we can create best practices and develop future guidelines. Standards can provide consistent guidance for municipalities and the province as we adopt proven technologies using a principled and measured approach.

It is critical that our approach to technology be intentional and evidence-based. Even as the public expects electoral management bodies to find efficiencies through technology, they are also increasingly aware of the possible failures of technology. While there are many benefits to using technology, there are risks involved, as illustrated by recent failures of systems at large organizations.

As the public becomes more informed about software, malware and manipulation of technology data systems, they are increasingly interested in knowing exactly how election technology preserves the integrity of our electoral process and the confidentiality of their personal information. For the public to trust the integrity of the electoral process they must be assured that:

  • Technology used to cast a vote will accurately count the vote as intended.
  • Technology used to cast a vote will uphold the secrecy of the vote.
  • Technology used to tabulate votes will be verifiable and protected from tampering.
  • Technology used to transmit election results will be verifiable and protected from tampering.
  • Technology will not result in the breach of their confidential and personal information.

To ensure we maintain public trust in our electoral system as we adopt technology, the Chief Electoral Officer recommends that Ontario establish a set of common evaluative standards and guidelines. These will advise election administrators as they consider which technology to adopt, how to evaluate the technology, and the specific technical standards to consider for adopted technology.

This is a very significant step forward for Elections Ontario.  In particular I laud the phrase “It is critical that our approach to technology be intentional and evidence-based.”

There is also a strong statement of principles at the end of the report

We continue to balance making voting easier for Ontarians with the need to preserve the integrity of the electoral process. We want to provide modernized, flexible, and convenient ways to vote, but cannot compromise the core covenants of our democracy: accessibility, one vote per elector, secrecy, integrity and security. As we continue on this modernization journey, these values will continue to be at the centre of the work we do.

As a starting point, the principles above are very good, and to them I would add the implementation criteria from Ontario’s own 2013 report on Alternative Voting Technologies.

Our implementation criteria are:

  • Accessibility:
    The voting process is equally accessible to all eligible voters, including voters with disabilities. The voting process will be performed by the voter without requiring any assistance for making their selections.
  • Individual verifiability:
    The voting process will provide means for the voter to verify that their vote has been properly deposited inside the virtual ballot box.
  • One vote per voter:
    Only one vote per voter is counted for obtaining the election results. This will be fulfilled even in the case where the voter is allowed to cast their vote on multiple occasions (in some systems, people can cast their vote multiple times, with only the last one being counted).
  • Voter authentication and authorization:
    The electoral process will ensure that before allowing a voter to cast a vote, that the identity of the voter is the same as claimed, and that the elector is eligible to vote.
  • Only count votes from valid voters:
    The electoral process shall ensure that the votes used in the counting process are the ones cast by valid eligible voters.
  • Voter privacy:
    The voting process will prevent at any stage of the election the ability to connect a voter and the ballots cast by the voter.
  • Results validation:
    The voting process will provide means for verifying if the results clearly represent the intention of the voters that participated in the voting process.
  • Service availability:
    The election process and any of its critical components (e.g., voters list information, cast votes, voting channel, etc.) will be available as required to voters, election managers, observers or any other actor involved in the process.

However, those principles need to be refined for a computer-based system, which the report also does

If the implementation of the network voting system does not both support the Chain of Trust and provide auditable evidence, then the process is open to question. This Chain of Trust is a compilation of all the following measures:

  1. Source code audit to verify that the code will do only what it is intended to do.
  2. Digital signature of the audited source code to protect its authenticity and integrity.
  3. Trusted build of the executable code in front of auditors (based on audited source code).
  4. Signature of the executable code to protect its authenticity and integrity.
  5. Deployment of the executable software in a clean system. Logical sealing of the system to detect any later additions.
  6. Logic and accuracy testing of the voting system to validate it works properly.
  7. Continuous audit of the voting system during the election, through review and validation of logs and other data. The logs must be protected from external manipulations by using cryptographic measures.
  8. Post-election audit that validates that the system behaved correctly by reviewing the logical seals and the protected logs.
  9. Individual voter verification that proves their ballots were used in the final tally (by using special receipts).

A strong emphasis must be placed on audit. Independent auditors must be able to review the source code, verify the build and deployment, audit system logs during the election event, and finally to review both the counting process and the results.

Those are strong starting points, and even more so because they emerge from Ontario’s own multi-year research into the subject.
That being said, Ontario also needs to heed the conclusion of the Alternative Voting Technologies report:

At this point, we do not have a viable method of network voting that meets our criteria and protects the integrity of the electoral process.

It is possible that the introduction of standards for municipal online voting could open the door to provincial online voting, and indeed the very-high-level Elections Ontario Strategic Plan 2019 – 2023 (PDF) says

Advance modern elections in a measured and principled manner

  • Assess and analyze the environment to inform the modernization of future elections.
  • Better understand electors’ needs and behaviours to build modern and responsive services.
  • Recommend legislative change to support modernization of electoral services.
  • Pilot modernization initiatives through by-elections.

It’s not at all clear what this “modernization” might include.

Conclusion

It is critical that both the current deployment and any potential further expansion of online voting should be subject to extensive analysis by computer security experts.

By applying an evidence-based approach to technology with extensive public, independent, unrestricted testing of election technology, Elections Ontario has the opportunity to move from what it acknowledges has been an ad-hoc approach to one that brings the appropriate levels of standards, testing, certification and auditing in what is a high-risk cybersecurity environment.

Additionally, Elections Ontario needs to close an auditing gap by putting in place risk-limiting audits for the computer vote counting it is now using for provincial elections.  We cannot simply trust the counts produced by the vote tabulators (because computers can be programmed to produce whatever result the programmer wants); we must have a public audit to increase the confidence in the results.

I hope that municipalities and the provincial government will accept that putting standards in place may result in the decertification and withdrawal of voting technology, as has happened when “electronic voting machines” were examined in the United States and when Switzerland made one of its online voting solutions available for public testing.

Considering online voting including Estonia

There are three fundamental challenges with public discussions about online voting:

  • The majority of computer scientists, particularly computer scientists with expertise in voting systems, recommend again online voting, but journalistic false balance often presents this as one computer scientist vs. one online voting advocate.
  • The dedicated resources available from nations and vendors to promote online voting vastly outweigh the nondedicated volunteer resources available from computer security experts to explain the issues with online voting.
  • Voting appears simple but is actually complex, with many essential requirements that are hard to capture in a soundbite.  This makes it easier to make a convincing-sounding but incorrect “common sense” convenience argument for online voting than to make the correct technical requirements counter-argument.

Consensus Opinion

Basically if the press were actually representative about this “debate”, it would be like John Oliver’s classic expert-weighted debate, with 97 experts on one side and 3 sceptics on the other.  So any time you see an online voting “debate” on TV or in print, I want you to imagine 97 expert computer scientists recommending against online voting, and 3 promoters with various agendas advocating for it.

I don’t have the ability to construct that kind of visual, but just to make it clear, what I am writing recommending against online voting is not just one voice, and it’s not just 16 leading computer security experts, it’s the overwhelming consensus view. It’s the view in the computer scientist community.  In 2004 the Association for Computing Machinery, the world’s largest scientific and educational  computing society (with a membership now of approximately 100,000) issued a Statement on Voting Systems, which includes the following text

voting systems should enable each voter to inspect a physical (e.g., paper) record to verify that his or her vote has been accurately cast and to serve as an independent check on the result produced and stored by the system.

It’s this consensus view that is summarized by the City of Toronto

The overwhelming consensus among computer security experts is that Internet voting is fundamentally insecure and cannot be safely implemented because of security vulnerabilities inherent in the architecture and organization of both the Internet and commonly used software/hardware

And if you wish there were some process to assemble a scientifically representative consensus into a document, well, I have good news.  The US National Academies of Sciences, Engineering and Medicine (NASEM) knows exactly how to run a process to report on expert consensus, and they did.  Their report recommends against Internet voting.

Secure Internet voting will likely not be feasible in the near future.

So to be blunt, if you’re in favour of online voting, you’re against the scientific consensus.  You’re also against the conclusion of 99.5% of the countries in the world.

National Online Voting Only In One Country

There are approximately 200 countries in the world.  Of those, the number of countries that offer online voting for all citizens in all elections is one.  One country of approximately 1.3 million citizens, where the total number of votes cast in each election is roughly 600,000.  Where the majority of voters still cast their votes on paper, on election day.

One country where offering online voting is part of branding the nation as e-Estonia, including consistent promotion.  Does your country invest in promoting its election system internationally?  Maybe that’s why there aren’t many international news stories about your country’s voting system, but there are lots about Estonia’s.

Computer security experts simply don’t have the scale and reach that a national public relations initiative has.

It takes months of dedicated journalism to do a comprehensive story about the issues with online voting.  Which, fortunately Eric Geller did: Online voting is a cybersecurity nightmare.

Unfortunately, the reality of deadlines, lack of expertise in computer security and lack of expertise in the actual requirements for voting systems means that most articles don’t go into the same depth.

As a result, reporting on Estonia’s online voting tends to be relentlessly positive.

But in article after article there are also a number of things that don’t get said about Estonian elections, including:

  • turnout declined in the last national election, in the last two local elections, and in the 2014 European Parliamentary election
  • turnout in the 2015 Estonian national election was lower than turnout in Canada and the UK

Estonia national turnout 2015

  • the smallest number of votes cast is by the 18-24 year old age group
  • online voting is offered for advance voting only, and requires a national digital identification infrastructure
  • Although Estonia has observing, auditing and testing procedures, the only time international computer security experts were invited to observe the process was in 2014.  Those outside observers found “There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers”. Since that report, international computer security experts have not been invited back.

You can read about the 2014 study in Practical Attacks on Real-world E-voting, 7.3.2 Estonia’s Internet Voting System. Or you can watch J. Alex Halderman explain it

SIDEBAR: The 2016 study by the Cyber Studies Programme at the Department of Politics and International Relations, University of Oxford.

The University of Oxford conducted a study of Estonia’s Internet voting in 2016, entitled The Estonian Internet Voting System – An Independent Assessment of the Procedural Components.

It’s important to note the “procedural components” part of the description.  The study (PDF) states specifically:

We review the general procedural security components of the system, particularly procedural security controls, …. We therefore do not focus on software engineering or encryption related issues in the computer systems.

Additionally, this study was based on reported procedures, not direct observation.

Finally, we must state that there is one main limitation to our work. This relates to the fact that our research relies on interview reports on voting processes and systems from individuals in Estonia, as opposed to direct observation of the I-Voting system in process.

The 2016 Oxford study is therefore not comparable in either scope or methods to the direct observations of the international experts in the 2014 Independent Report on E-voting in Estonia.

END SIDEBAR

All Countries That Study Online Voting Reject It

At a national level, Internet voting has been studied by the Parliament of Australia, by a Canadian Parliamentary Committee, and by Finland.  Each study recommended against online voting.

Lithuania was considering online voting, but as best I can conclude through a layer of Google translation, has rejected it on national security grounds.

“Interior Minister Eimutis Misiūnas is still skeptical about online voting, according to him, until there is an absolute guarantee of security, elections must take place in a traditional way.”

LRT.lt – E. Misiūnas dėl balsavimo internetu – kol kas skeptiškas (March 1, 2018)

Rytis Rainys, Director of the National Cyber ​​Security Center, is not sure about the security of online voting.
“Fears about cyber security are one of the main reasons why this process stops,” he said. – These fears are not only justified but also based on facts, mass incidents that we have in Lithuania.”

LRT.lt – Internetu balsuojanti estė: tai nepalanku kai kurioms partijoms (February 28, 2019)

Online Voting And National Security

When Deloitte studied cybersecurity as it relates to elections for Australia, they found

The main concern is not the actual damage that cyber attacks can cause to individual electoral system components, although it exposes the individual jurisdiction to significant reputational damage. The bigger concern is that any reports of attempted or successful breaches gives adversaries the ability to sow doubt in the security and integrity of electoral processes.

Australia – Electoral Cyber Security Maturity Review: Whole of Nation Report (Deloitte Touche Tohmatsu report CN3550609 for the Department of Home Affairs – October 2018 – redacted)

So it’s not just that an online election can and will be attacked, it’s that the obscurity and lack of transparency of an online election opens it up to the opportunity of undermining trust in elections as a whole.

These are real threats.  Canada’s Centre for Cyber Security says

In 2018, half of all advanced democracies holding national elections had their democratic process targeted by cyber threat activity. This represents about a three-fold increase since 2015 and we expect the upward trend to continue in 2019.

2019 Update: Cyber Threats to Canada’s Democratic Process – Executive Summary

Online Voting Fails In Independent Testing

But even if you’re not convinced by the fact that the majority of computer scientists, and the majority of nations, and national security advisors are all against online voting, what about a real-world independent test?

Well, Switzerland fortunately has a legal framework in place that requires independent testing of proposed online voting solutions.

And when their online voting was independently examined (outside of the restrictions they had placed on the testing), it was found to be insecure. So they have withdrawn it.

Online Voting Fails When Deployed

Online municipal voting in Ontario failed in 2010 and again in 2018.

Home Computers Are Insecure

And remember you don’t just have to be concerned that the online voting code itself is insecure, people vote from their home computers, over the Internet to centralised servers.  Elections agencies have no control over the security of home computers and the Internet, and they have no control over when major security flaws will be discovered and patches will be released.  Such as for example the week of May 13th, 2019, when there was:

In fact, the US Computer Emergency Readiness Team (US-CERT) listed 99 (yes, ninety-nine) high-severity computer security vulnerabilities just for the week of May 13, 2019 alone.  And all of those computer security vulnerabilities, some of which will take weeks or months for consumers and organisations to patch (if ever), they all took place in the same week that Estonia opened its online voting on May 16th.  So you can be guaranteed that people were voting from insecure computers.

Vendors Control Most Internet Voting

And in addition to all of those factors, the reality in Canada and most other countries is that elections technology is created by third-party, for-profit vendors who shield their code and processes from inspection using intellectual property law.  This means elections are effectively outsourced to opaque third-party organisations.  I’ve written about this in the context of Ontario’s computer vote counting, and I would add that Ontario specifically stated their need to work closely with vendors

Throughout the planning phase, we worked closely with our vendors to establish accurate requirements, conduct necessary testing, determine support, and ensure the integrity of the election was never compromised. We were able to integrate vendors into the design and administration of the election, and we look forward to a strong working relationship with our vendors into the future.

Elections Ontario – Modernizing Ontario’s Electoral Process: Report on Ontario’s 42nd General Election June 7, 2018 – Section 2: Planning a Transformative Election, B. Building the Team, Vendors

Tell me, if you wanted to increase the connection that the public feels with its election system, if you wanted to bridge the gap between the public and its democratic system, would your first choice be less involvement of the public?  Because “integrating vendors” means removing the public from the inner workings of the election system itself.

And if you think at least the vendors must be experts in computer security, their record is abysmal.  In the 2007 Ohio EVEREST study, independent researchers found

“exploitable security weaknesses in all three vendors’ systems”

Ohio EVEREST Voting StudyStatement

Conclusion

With all that to consider, if you only have one takeaway from this entire blog post it is this:

you must demand public, independent, expert testing without restrictions before you place your confidence in online voting

Such testing has not taken place for the online voting in Ontario and Nova Scotia municipal elections.

There are too many other problems with online voting for me to summarize in what is already a long blog post, so I will conclude with two previous summaries I have done:

Open Source code and Canadian elections

Here’s what I wrote in response to some confusion about Canadian elections in the comments on Schneier on Security blog post DARPA Is Developing an Open-Source Voting System

Sfan and Earnest – In response to Sfan’s statement “FWIW, Elections Canada used a paper & marker ballot system and a human & paper based voter validation system until 2015.”

Elections Canada runs federal elections only, and continues to use hand-marked paper ballots that are hand counted. See e.g. https://twitter.com/ElectionsCan_E/status/1105136418639233024

You might be confusing Elections Canada with Elections ONTARIO, which has recently switched from hand-counted ballots to vote counting computers for provincial elections. With, I might add, zero provision for risk-limiting audits.

Municipal elections in Ontario, which are governed by provincial election law, use a mix of vote counting computers (as in the City of Ottawa) and completely unregulated Internet voting. Internet voting run by third-party for-profit companies with zero public availability of source code, zero public security testing, and no legislative provisions for either.

In terms of the substance of Schneier’s blog post, there are also some issues. He quotes

The system will use fully open source voting software, instead of the closed, proprietary software currently used in the vast majority of voting machines, which no one outside of voting machine testing labs can examine. More importantly, it will be built on secure open source hardware, made from special secure designs and techniques developed over the last year as part of a special program at DARPA [Defense Department’s Defense Advanced Research Projects Agency].

(Emphasis on special mine.)

Issues to consider:

  • Open source is better (because it can be inspected) but ultimately useless as a voting computer improvement because you cannot prove what code is running on a computer.
  • In theory you can address the issue of what code is running by having secure hardware but there is no perfect hardware security, just like there is no perfect software security.  Additionally, election security is about universally understandable verifiability.  Any citizen should be able to understand the election process and the results.  “Trust us, this special hardware is secure” is no different than “trust us while we go in this special locked room and secretly produce the election results”.
  • Similarly, in theory you can use cryptographic techniques to improve the security and verifiability of the election, but the only people who can actually understand them is a tiny set of cryptographers.  To everyone else you’re saying “trust us, this special crypto code is secure” which is no different than “trust us while we go in this special locked room and secretly produce the election results”.

Having open source is better, having public inspection and testing of the code is better, having verified cryptography is better, but none of these improvements to computer vote counting address the fundamental issue which is that you can’t do computer vote counting in a way that is transparently understandable by every voter, and so you shouldn’t be doing computer vote counting at all.

Plus which, in practice you can’t tell what code is running on a computer anyway, because computers can lie.  Computer programs are written by people; people can lie, and so they can tell computers to lie.  You can ask the computer “are you running this open source code” and the computer can say “oh yes, absolutely” even as it triggers the hidden election day malware that slightly alters votes just enough to tip the result to a different candidate.

At most, when you have very complicated ballots as in the US you can consider doing computer vote counting with hand-marked paper ballots and a risk limiting audit.  But for Canada’s extraordinarily simple elections, computer vote counting adds needless complexity, obscurity and risk to an already optimised system.

That being said, if we are stuck with Internet voting in Canadian municipal elections, open source code and public security testing is absolutely essential, as much because it will demonstrate repeatedly that the source code is both ridiculously complicated and insecure, as for the fact that it helps reduce (but definitely not eliminate) security risks.

In other words, open source and public security inspections are only about making something we shouldn’t be doing in the first place less terrible.  They are not an actual solution.  The actual solution is not to have Internet voting and computer vote counting at all in Canadian elections.