Category: Links to documents

Estonian Parliamentary Elections 2019 – ODIHR Election Expert Team Final Report – Internet Voting

The Office for Democratic Institutions and Human Rights (ODIHR) is a division of the Organization for Security and Co-operation in Europe.  The ODIHR has produced a report on the 3 March 2019 Estonian Parliamentary Elections.

ODIHR Election Expert Team Final Report – Estonia – Parliamentary Elections 3 March 2019 (PDF)

The ODIHR reviews a wide range of election conduct against international standards.  I will only extract selected parts of their report from section VII. Internet voting.  Numerous issues were identified.

In extracts below, EET = Election Expert Team and SEO = Estonian State Electoral Office.

Internal Attacks

the detection and prevention of internal attacks has been largely omitted. A review of operational and technical frameworks by the ODIHR EET indicates that an internal attacker with privileged access to digital ballots could break the vote secrecy of any voter who published an image of the QR code online, even after the expiry of the code’s validity. This contradicts national legislation and international standards pertaining to vote secrecy.21

RECOMMENDATION: The SEO could develop strategies to mitigate the risk of internal attacks, conduct third-party risk assessments, and publish any findings and audit reports well ahead of the next elections.

21 See Article 1(2) of the Election Act. Paragraph 7.4 of the OSCE Copenhagen Document requires that votes are cast by secret ballot or by equivalent free voting procedure. Paragraph 19 of the Council of Europe Committee of Ministers Recommendation CM/Rec(2017)5 on standards for e-voting requires that “E-voting shall be organized in such a way as to ensure that the secrecy of the vote is respected at all stages of the voting procedure”.

above from page 8 of the report

Software Errors May Cause Election Errors

The Internet voting system is not software independent, meaning that software errors in its components, such as the key generation system or the processor, may cause undetected errors in the election results. Considering publicly available records the system has undergone quality control activities but, contrary to international good practice, no reports were published on the SEO’s website, while updates to the source code were made as recently as three days before election day and well after Internet voting commenced.22

In addition, a limited source code review of the system by the ODIHR EET indicated issues regarding the treatment of concurrency, error handling, and error reporting.

RECOMMENDATION: The SEO could integrate quality assurance activities into the maintenance schedule of the voting solution and publish the security rationale and all quality assurance results, including design review, security analysis, and penetration testing results.

22 Paragraph 42 of the Recommendation CM/Rec(2017)5 on standards for e-voting states that “Before any e-election takes place, the electoral management body shall satisfy itself that the e-voting system is genuine and operates correctly.”

above from page 8 of report

External Auditors Did Not Audit All Operations

A team of external auditors was dispatched to assist the SEO with establishing vote secrecy during the computation of preliminary Internet voting results and the integrity of final Internet voting results by verifying the correctness of the cryptographic shuffle and decryption proofs. The team did not audit other critical operations, most notably the correct transmission of the final aggregation of the decrypted Internet votes.23

RECOMMENDATION: The SEO could strengthen its auditing process by developing a complete strategy and requiring auditors to implement critical auditing tools independently and from scratch.

23 Software independence requires that other operations are also independently audited, such as digital signature checking of all e-votes, removal of all duplicate and other ineligible votes from the digital ballot box, revocation, and anonymization. Paragraph 39 of the Recommendation CM/Rec(2017)5 on standards for e-voting states that “the audit system shall be open and comprehensive, and actively report on potential issues and threats.”

above from page 9

Technical Specifications Need Improvement

some key properties are not precisely formulated and left open to interpretation by the SEO and the vendor tasked to implement the Internet voting system, including minimal acceptable levels of cryptographic strength, and accountability and verifiability requirements. This may negatively impact the system’s overall performance and future innovation. The specifications also lack information about timelines and milestones for software development and deployment, and quality assurance.25

RECOMMENDATION: The technological specifications accompanying the legal framework could define acceptable voting systems in more general terms, but include additional requirements related to cryptographic strength, quality assurance, software development and deployment, as well as accountability and verifiability.

25 The Supreme Court considered two post-election appeals against NEC decisions related to Internet voting. While appeals were rejected, the Court recognized the need for more clear procedures and called for a legal clarification of rules on the implementation of Internet voting, in particular regarding counting and mixing of electronic ballots.

above from page 9

Internet voting in Norway

Norway conducted trials of Internet voting in 2011 and 2013.

Internet voting was discontinued after the trials found no improvement in turnout (including no increase in youth turnout), combined with security concerns.

An archive of reports in Norwegian and English is available: The e-vote trial.

Here are some highlights of the reports:

Evaluation of the e-voting trial in 2011 – English summary of Institutt for Samfunnsforskning (ISF) report

we find no evidence that groups of voters have been mobilized to take part in the election as a result of internet voting.

The analyses, in sum, indicate that the trial did not have an effect on voter turnout.

young voters prefer to walk to the polling station on Election Day. They defined traditional voting as a symbolic and ceremonial act that indicates adultness.

Evaluation of the e-voting trial in 2013 (PDF) – English text begins on p 135 (p 137 in PDF)

In line with previous research, our findings indicate that the trial with internet voting does not lead to increased turnout in elections.

The government announced in 2014 that Internet voting trials would be discontinued.

June 25, 2014 – Internet voting pilot to be discontinued

As there is no broad political desire to introduce internet voting, the Government has concluded that it will would be inappropriate to spend time and money on further pilot projects.

The Institute for Social Research evaluated the pilot project in 2013… The report shows that the voters have limited knowledge about the security mechanisms in the system.

“This shows how important it is that elections are conducted at polling stations where election officials make sure that the principle of free and fair elections and the secrecy of the vote is respected,” says [Minister of Local Government and Modernisation Jan Tore] Sanner.

In Norwegian – Ikke flere forsøk med stemmegivning over Internett

The BBC reported this as E-voting experiments end in Norway amid security fears.


As part of the project, in 2009 there was a report on security.  It notes the added risks from remote voting.

The system is no longer by necessity confined to the local polling station; conceivably it is accessible world-wide, thus increasing the potential number of attackers and attack vectors dramatically.

Also as part of the project, in 2012 there was 196-page report International Experience with E-Voting [with a focus on Internet Voting] (PDF).

Swiss voting technology law sets the standard, in theory

Switzerland – Federal Chancellery Ordinance on Electronic Voting 161.116 of 13 December 2013 (Status as of 1 July 2018)

Key Concepts in Theory

  • the system must be independently evaluated (Article 7, item 1)
  • risk must be assessed (Article 3)
  • the system must be evaluated against detailed requirements (Article 2, section a, Article 4, Article 7, item 2 and item 3)
  • the source code must be made available (Article 7a and Article 7b)

Also notable is that the default maximum authorised participation in electronic voting is 30%.  From above 30% to 50% additional requirements apply, and above 50% even more requirements apply.

In Practice

Unfortunately in practice, for a 2019 public intrusion test, the conditions on both the general testing and the availability of source code were restrictive.

There was not in any sense either unrestricted public testing nor unrestricted publically available open source code.

(If you’ve heard that the tested voting system was withdrawn when serious security flaws were found, this is true, but discovery of these security flaws happened through access to the source code outside of the restrictive agreement.)

My Recommendations

The Swiss ordinance has model principles that should be adopted for evaluating online voting.  In particular independent public evaluation and availability of public source code are key (although keep in mind that source code availability doesn’t mean perfect confidence in the code that actually runs).

The Swiss law is however too complex, and it allowed the interpretation loopholes that led to restrictive terms of use in practice.

Therefore the model principles for evaluating online voting must also include clear language on unrestricted public testing and unrestricted public access to source code.

It’s also important that the independent testing include not just funded open hacking competitions (which are useful) but also direct funding to academic research groups.  The cryptography used in modern voting systems is extraordinarily complex; the academics who are expert in it don’t have free time and don’t work for free.

(Even with academics funded to study the voting system, be mindful that nation-state attackers have far more time and resources to devote to finding flaws in systems, as well as having arsenals of zero-day attacks they could choose to deploy during an election.)

Detailed Technical Language

Below are extracts of the technical language from the ordinance.

Voting System Must Meet Requirements

Art 2. … The authorisation for electronic voting in any individual ballot shall be granted provided the following requirements are met:

a.
The system for electronic voting (the system) is implemented and operated so as to guarantee secure and trustworthy vote casting (Annex No 2 and 3).

There Must Be A Risk Assessment

Art 3. … By the means of a risk assessment, the canton must document in detailed and understandable terms that any security risks are within adequate limits. The assessment covers the following security objectives:

a.
the accuracy of the result;
b.
the protection of voting secrecy and non-disclosure of early provisional results;
c.
the availability of functionalities;
d.
the protection of personal information about voters;
e.
the protection of voter information against manipulation;
f.
the non-disclosure of evidence of vote casting behaviour.

Progressively Higher Requirements As Authorised Participation Increases

The ordinance takes an unusual approach which is to set progressively higher bars to increased availability of online voting. By default, the maximum percentage of the Swiss electorate allowed to use online voting is 30 percent (30%).

At 30% participation there is a minimum set of validation requirements

Art 7. 3If no more than 30 per cent of the cantonal electorate are to be authorised to participate in a trial and the system has the property of complete verifiability in terms of Article 5, the system and its operation must be examined in particular detail with regard to the following criteria:

a.
cryptographic protocol (Annex No 5.1);
b.
functionality (Annex No 5.2), whereby the examination may exclude the software in portals of authorities that are linked to a system;
c.
security of infrastructure and operation (Annex No 5.3), whereby the examination may be limited to the infrastructure that registers the vote and creates the proof for the voter in accordance with Article 4 paragraph 2;
d.
protection against attempts to infiltrate the infrastructure (Annex No 5.5);
e.
control components (Annex No 5.4).2

To exceed 30%

Art 4.1If a system is to be authorised to cover more than 30 per cent of the cantonal electorate, the voters must be able to ascertain whether their vote has been manipulated or intercepted on the user platform or during transmission (individual verifiability, Annex No 4.1 and 4.2).

along with other conditions

Above 30% participation there are also different validation requirements

Art 7. 2If more than 30 per cent of the cantonal electorate are to be authorised to participate in a trial (Art. 4 and 5), the system and its operation must be examined in particular detail with regard to the following criteria:

a.
cryptographic records (Annex No 5.1);
b.
functionality (Annex No 5.2);
c.
security of infrastructure and operation (Annex No 5.3);
d.
protection against attempts to infiltrate the infrastructure (Annex No 5.5);
e.
requirements for printing offices (Annex No 5.6);
f.1
when using a system has the property of complete verifiability in terms of Article 5: control components (Annex No 5.4).

To exceed 50%

Art 5.1If a system is to be authorised to cover more than 50 per cent of the cantonal electorate, it must be ensured that voters or the auditors are able, subject to compliance with voting secrecy, to identify any manipulation that leads to falsification of the result (complete verifiability, Annex No 4.3 and 4.4).

along with other conditions

Independent Assessment

Art. 7 Requirements for examinations

1 The cantons shall ensure that meeting the requirements is examined by independent agencies. The examination is made in particular if the system or its operation has been changed in such a way that meeting the requirements for authorisation could be called into question.

Publication of Source Code

Publication of source code is required, but it’s tangled in the level of authorised participation and in other attributes, so I will just include the entire section

Art. 7a1Publication of the source code

1 The source code for the system software must be made public.

2 Publication shall take place when the system has the property of complete verifiability in terms of Article 5, and:

a.
following the examination in accordance with Article 7 paragraph 2 if more than 30 per cent of the cantonal electorate are to be authorised to participate in a trial;
b.
following the examination in terms of Article 7 paragraph 3 if no more than 30 per cent of the cantonal electorate are to be authorised to participate in a trial.

3 There is no requirement to publish the source code of the following:

a.
third-party components such as operating systems, databases, web and application servers, rights management systems, firewalls or routers, provided these are freely available and regularly updated;
b.
portals of authorities that are linked to a system.

1 Inserted by No I of the FCh O of 30 May 2018, in force since 1 July 2018 (AS 2018 2279).

Art. 7b1Modalities for publishing the source code

1 The source code must be prepared and documented according to the best practices.

2 It must be easily obtainable, free of charge, on the internet.

3 The documentation on the system and its operation must explain the relevance of the individual components of the source code for the security of electronic voting. The documentation must be published along with the source code.

4 Anyone is entitled to examine, modify, compile and execute the source code for ideational purposes, and to write and publish studies thereon. The owner of the source code may permit its use for other purposes.

1 Inserted by No I of the FCh O of 30 May 2018, in force since 1 July 2018 (AS 2018 2279).

Official Versions

As English is not an official language of Switzerland, the annexes to the ordinance and explanations about the ordinance are available only in German, French and Italian.  The annexes provide additional technical detail and there was also an explanatory report produced in 2018 providing context about the need to publish the source code.

UPDATE 2019-05-24: Also see the E-voting home pages and policy pages for each language

Questions about online absentee voting in the NWT

The Northwest Territories (NWT) will be introducing the option of online voting for absentee voting in the October 2019 Territorial General Election.

For context, “In total, 12,702 ballots were cast in the 2015 Territorial General Election, representing a 44 percent [44%] voter turnout.”  The total number of registered electors was 28,662.  In the 2015 Territorial General Election the total number of absentee ballots was 110 (one hundred and ten).  – Data from 2015 Official Voting Results, Elections NWT (PDF).

Questions to ask

  • What vendor(s) have been procured?
  • What regulations and procedures are in place per NWT Elections Act 132.1. and 360.(f) ?
  • What has been done to ensure a reliable, practical, tested system?

UPDATE 2019-07-04: From CBC article N.W.T. to be 1st province or territory to use online voting in general election we now have some answers:

Simply Voting will be the vendor.

Hitachi will be testing the website.

However, we still don’t know what kind of testing Hitachi is conducting, and we don’t know whether Hitachi’s report will be released to the public.

There is also still no information about online voting regulations and procedures, even though provisions for these are present in the NWT Elections Act 132.1. and 360.(f).

END UPDATE

Background

The authority to conduct online absentee voting, described in law as “voting by absentee ballot by electronic means”, comes from the NWT Elections and Plebiscites Act, as amended November 20, 2018 (PDF).  There are two relevant sections:

132.1. The Chief Electoral Officer may, in accordance with the regulations, establish procedures in respect of voting by absentee ballot by electronic means. S.N.W.T. 2018,c.16,s.40.

360. The Commissioner, on the recommendation of the Chief Electoral Officer, may make regulations

(f)  respecting voting by absentee ballot by electronic means, including regulations that specify which, if any, of the provisions of this Act regarding absentee ballots are to apply to voting by absentee ballot by electronic means.

S.N.W.T. 2010, c.15,s.50; S.N.W.T. 2018,c.16,s.73.

In reviewing the proposal for online absentee voting before the changes to the NWT Elections Act were made, the Standing Committee on Rules and Procedures provided feedback in 2017

The Committee supports amending the Act to allow for the option of electronic voting for absentee ballots in the NWT when a reliable, practical system can be tested and implemented.

Committee Report 1-18(3) / October 17, 2017 / 18th Legislative Assembly of the Northwest Territories, Standing Committee on Rules and Procedures / Report on the Review of the Chief Electoral Officer’s Report on the Administration of the 2015 Territorial General Election, Supplementary Recommendations, and the White Paper on the Independence and Accountability of Election Administration in the Northwest Territories (PDF)

Regulations and Procedures, Reliable Tested System

Accordingly, there should be regulations per NWT Elections Act 360.(f) and procedures per 136.1.

The system should also be tested and demonstrated to be reliable and practical per the Standing Committee on Rules and Procedures report.

Unfortunately I am unable to locate any regulations, procedures, or testing information online.  This is a major gap in all Canadian online voting to date, with an absence of standards and independent public testing.  I hope that Elections NWT will provide this information and make their system available for testing.

(To be clear, I don’t think there should be online voting at all, but if there is going to be, there must be independent, unrestricted public testing first.)

For more information, see:

Considering online voting including Estonia

There are three fundamental challenges with public discussions about online voting:

  • The majority of computer scientists, particularly computer scientists with expertise in voting systems, recommend again online voting, but journalistic false balance often presents this as one computer scientist vs. one online voting advocate.
  • The dedicated resources available from nations and vendors to promote online voting vastly outweigh the nondedicated volunteer resources available from computer security experts to explain the issues with online voting.
  • Voting appears simple but is actually complex, with many essential requirements that are hard to capture in a soundbite.  This makes it easier to make a convincing-sounding but incorrect “common sense” convenience argument for online voting than to make the correct technical requirements counter-argument.

Consensus Opinion

Basically if the press were actually representative about this “debate”, it would be like John Oliver’s classic expert-weighted debate, with 97 experts on one side and 3 sceptics on the other.  So any time you see an online voting “debate” on TV or in print, I want you to imagine 97 expert computer scientists recommending against online voting, and 3 promoters with various agendas advocating for it.

I don’t have the ability to construct that kind of visual, but just to make it clear, what I am writing recommending against online voting is not just one voice, and it’s not just 16 leading computer security experts, it’s the overwhelming consensus view. It’s the view in the computer scientist community.  In 2004 the Association for Computing Machinery, the world’s largest scientific and educational  computing society (with a membership now of approximately 100,000) issued a Statement on Voting Systems, which includes the following text

voting systems should enable each voter to inspect a physical (e.g., paper) record to verify that his or her vote has been accurately cast and to serve as an independent check on the result produced and stored by the system.

It’s this consensus view that is summarized by the City of Toronto

The overwhelming consensus among computer security experts is that Internet voting is fundamentally insecure and cannot be safely implemented because of security vulnerabilities inherent in the architecture and organization of both the Internet and commonly used software/hardware

And if you wish there were some process to assemble a scientifically representative consensus into a document, well, I have good news.  The US National Academies of Sciences, Engineering and Medicine (NASEM) knows exactly how to run a process to report on expert consensus, and they did.  Their report recommends against Internet voting.

Secure Internet voting will likely not be feasible in the near future.

So to be blunt, if you’re in favour of online voting, you’re against the scientific consensus.  You’re also against the conclusion of 99.5% of the countries in the world.

National Online Voting Only In One Country

There are approximately 200 countries in the world.  Of those, the number of countries that offer online voting for all citizens in all elections is one.  One country of approximately 1.3 million citizens, where the total number of votes cast in each election is roughly 600,000.  Where the majority of voters still cast their votes on paper, on election day.

One country where offering online voting is part of branding the nation as e-Estonia, including consistent promotion.  Does your country invest in promoting its election system internationally?  Maybe that’s why there aren’t many international news stories about your country’s voting system, but there are lots about Estonia’s.

Computer security experts simply don’t have the scale and reach that a national public relations initiative has.

It takes months of dedicated journalism to do a comprehensive story about the issues with online voting.  Which, fortunately Eric Geller did: Online voting is a cybersecurity nightmare.

Unfortunately, the reality of deadlines, lack of expertise in computer security and lack of expertise in the actual requirements for voting systems means that most articles don’t go into the same depth.

As a result, reporting on Estonia’s online voting tends to be relentlessly positive.

But in article after article there are also a number of things that don’t get said about Estonian elections, including:

  • turnout declined in the last national election, in the last two local elections, and in the 2014 European Parliamentary election
  • turnout in the 2015 Estonian national election was lower than turnout in Canada and the UK

Estonia national turnout 2015

  • the smallest number of votes cast is by the 18-24 year old age group
  • online voting is offered for advance voting only, and requires a national digital identification infrastructure
  • Although Estonia has observing, auditing and testing procedures, the only time international computer security experts were invited to observe the process was in 2014.  Those outside observers found “There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers”. Since that report, international computer security experts have not been invited back.

You can read about the 2014 study in Practical Attacks on Real-world E-voting, 7.3.2 Estonia’s Internet Voting System. Or you can watch J. Alex Halderman explain it

SIDEBAR: The 2016 study by the Cyber Studies Programme at the Department of Politics and International Relations, University of Oxford.

The University of Oxford conducted a study of Estonia’s Internet voting in 2016, entitled The Estonian Internet Voting System – An Independent Assessment of the Procedural Components.

It’s important to note the “procedural components” part of the description.  The study (PDF) states specifically:

We review the general procedural security components of the system, particularly procedural security controls, …. We therefore do not focus on software engineering or encryption related issues in the computer systems.

Additionally, this study was based on reported procedures, not direct observation.

Finally, we must state that there is one main limitation to our work. This relates to the fact that our research relies on interview reports on voting processes and systems from individuals in Estonia, as opposed to direct observation of the I-Voting system in process.

The 2016 Oxford study is therefore not comparable in either scope or methods to the direct observations of the international experts in the 2014 Independent Report on E-voting in Estonia.

END SIDEBAR

All Countries That Study Online Voting Reject It

At a national level, Internet voting has been studied by the Parliament of Australia, by a Canadian Parliamentary Committee, and by Finland.  Each study recommended against online voting.

Lithuania was considering online voting, but as best I can conclude through a layer of Google translation, has rejected it on national security grounds.

“Interior Minister Eimutis Misiūnas is still skeptical about online voting, according to him, until there is an absolute guarantee of security, elections must take place in a traditional way.”

LRT.lt – E. Misiūnas dėl balsavimo internetu – kol kas skeptiškas (March 1, 2018)

Rytis Rainys, Director of the National Cyber ​​Security Center, is not sure about the security of online voting.
“Fears about cyber security are one of the main reasons why this process stops,” he said. – These fears are not only justified but also based on facts, mass incidents that we have in Lithuania.”

LRT.lt – Internetu balsuojanti estė: tai nepalanku kai kurioms partijoms (February 28, 2019)

Online Voting And National Security

When Deloitte studied cybersecurity as it relates to elections for Australia, they found

The main concern is not the actual damage that cyber attacks can cause to individual electoral system components, although it exposes the individual jurisdiction to significant reputational damage. The bigger concern is that any reports of attempted or successful breaches gives adversaries the ability to sow doubt in the security and integrity of electoral processes.

Australia – Electoral Cyber Security Maturity Review: Whole of Nation Report (Deloitte Touche Tohmatsu report CN3550609 for the Department of Home Affairs – October 2018 – redacted)

So it’s not just that an online election can and will be attacked, it’s that the obscurity and lack of transparency of an online election opens it up to the opportunity of undermining trust in elections as a whole.

These are real threats.  Canada’s Centre for Cyber Security says

In 2018, half of all advanced democracies holding national elections had their democratic process targeted by cyber threat activity. This represents about a three-fold increase since 2015 and we expect the upward trend to continue in 2019.

2019 Update: Cyber Threats to Canada’s Democratic Process – Executive Summary

Online Voting Fails In Independent Testing

But even if you’re not convinced by the fact that the majority of computer scientists, and the majority of nations, and national security advisors are all against online voting, what about a real-world independent test?

Well, Switzerland fortunately has a legal framework in place that requires independent testing of proposed online voting solutions.

And when their online voting was independently examined (outside of the restrictions they had placed on the testing), it was found to be insecure. So they have withdrawn it.

Online Voting Fails When Deployed

Online municipal voting in Ontario failed in 2010 and again in 2018.

Home Computers Are Insecure

And remember you don’t just have to be concerned that the online voting code itself is insecure, people vote from their home computers, over the Internet to centralised servers.  Elections agencies have no control over the security of home computers and the Internet, and they have no control over when major security flaws will be discovered and patches will be released.  Such as for example the week of May 13th, 2019, when there was:

In fact, the US Computer Emergency Readiness Team (US-CERT) listed 99 (yes, ninety-nine) high-severity computer security vulnerabilities just for the week of May 13, 2019 alone.  And all of those computer security vulnerabilities, some of which will take weeks or months for consumers and organisations to patch (if ever), they all took place in the same week that Estonia opened its online voting on May 16th.  So you can be guaranteed that people were voting from insecure computers.

Vendors Control Most Internet Voting

And in addition to all of those factors, the reality in Canada and most other countries is that elections technology is created by third-party, for-profit vendors who shield their code and processes from inspection using intellectual property law.  This means elections are effectively outsourced to opaque third-party organisations.  I’ve written about this in the context of Ontario’s computer vote counting, and I would add that Ontario specifically stated their need to work closely with vendors

Throughout the planning phase, we worked closely with our vendors to establish accurate requirements, conduct necessary testing, determine support, and ensure the integrity of the election was never compromised. We were able to integrate vendors into the design and administration of the election, and we look forward to a strong working relationship with our vendors into the future.

Elections Ontario – Modernizing Ontario’s Electoral Process: Report on Ontario’s 42nd General Election June 7, 2018 – Section 2: Planning a Transformative Election, B. Building the Team, Vendors

Tell me, if you wanted to increase the connection that the public feels with its election system, if you wanted to bridge the gap between the public and its democratic system, would your first choice be less involvement of the public?  Because “integrating vendors” means removing the public from the inner workings of the election system itself.

And if you think at least the vendors must be experts in computer security, their record is abysmal.  In the 2007 Ohio EVEREST study, independent researchers found

“exploitable security weaknesses in all three vendors’ systems”

Ohio EVEREST Voting StudyStatement

Conclusion

With all that to consider, if you only have one takeaway from this entire blog post it is this:

you must demand public, independent, expert testing without restrictions before you place your confidence in online voting

Such testing has not taken place for the online voting in Ontario and Nova Scotia municipal elections.

There are too many other problems with online voting for me to summarize in what is already a long blog post, so I will conclude with two previous summaries I have done:

Internet voting doesn’t increase turnout and isn’t reliable

The claims made for Internet voting include:

  • it will increase overall turnout
  • it will increase youth turnout
  • it will be more efficient and reliable than paper-based, human-counted elections

And here is the reality:

  • it doesn’t increase overall turnout
  • it doesn’t increase youth turnout, and in fact young people cast the fewest votes using Internet voting
  • it crashes

That is to say, Internet voting doesn’t even have the benefits claimed for it, setting aside the fact that even if it did, it would be a terrible idea from a security and election transparency perspective.

I don’t have the ability to go through every single one of the hundreds of 2018 Municipal Election reports from the hundreds of (mostly tiny) municipalities in Ontario that used Internet voting, many of them offering only Internet voting (no paper option at all).  But I can give as an example Hanover, Ontario, with 5,411 eligible voters.

Report CAO-05-19 – 2018 Post Election & Accessibility Report, pp. 113-125 of February 4, 2019 Committee of the Whole.pdf

Key sections:

Turnout

The final voters’ list was comprised of 5,411 eligible electors with 2,632 or 48.64% voting. This represented a decline from 56.39% in 2014

Voter turnout was markedly lower among those aged 35 or younger than with those aged 55 or older. Turnout was highest among those aged 60 and over, consistently bettering 60% for both men and women. However, turnout was lowest among those under the age of 35.

Voting Outage and State of Emergency

Due to technical issues in the closing hours of the election, the clerk declared an emergency under section 53 of the Act. Under the circumstances, the decision was made to extend the voting period by 24 hours with the polls officially closing at 8:00 pm on October 23, 2018. 49 municipalities, all clients of Dominion Voting Systems (DVS), were affected by the same technical problem and extended their voting period.

I find it remarkable that given that Internet voting delivers on none of its supposed turnout benefits, and fails in ways that paper elections can’t, Ontario municipalities still plan to use it for the next election.

These results about turnout aren’t new – you can see many other examples in my blog post Online voting doesn’t increase turnout.

I have also extracted Grey County 2018 Municipal Election Turnout, which gives a sense not only of the size of the municipalities involved, but also shows that none of them exceeded 50% turnout.

Grey County 2018 Municipal Election Turnout

In order to give an overall sense of the election, I include 2018 Municipal Elections Post-Election Summary by Municipal Service Office (MSO) – there are five regional MSOs.  It shows a more complicated turnout picture, but basically the conclusion is that Internet voting doesn’t bring dramatic turnout improvements.

2018 Municipal Elections Post-Election Summary by MSO JPEG 300

Securing the Vote – US National Academies 2018 consensus report

The US National Academies of Sciences, Engineering and Medicine (NASEM) uses a comprehensive study process http://www.nationalacademies.org/studyprocess/ to ensure high standards of scientific and technical quality.

On September 6, 2018 they released their 2018 consensus report

Securing the Vote: Protecting American Democracy

The report is available to download as a PDF (login isn’t required, you can download as a guest) and is also posted to read online.  (See blog note 1 for the definition of a consensus report.)

The key conclusions highlighted in the introduction to the release are:

All U.S. Elections Should Use Paper Ballots by 2020 …; Internet Voting Should Not Be Used at This Time

Emphasis (bolding) above mine.

Ensuring the Integrity of Elections

Chapter 5: Ensuring the Integrity of Elections contains many sections relevant to voting technology.  Below are selected extracts only; please read the entire chapter for the full details.

Malware (pp. 86-87)

Malware can be introduced at any point in the electronic path of a vote—from the software behind the vote-casting interface to the software tabulating votes—to prevent a voter’s vote from being recorded as intended.

Maintaining Voter Anonymity (pp. 87-88)

With remote voting—voting outside of publicly monitored poll sites—it may not be difficult to compromise voter privacy. When voting, for example, by mail, fax, or via the Internet, individuals can be coerced or paid to vote for particular candidates outside the oversight of election administrators.

Election Cybersecurity

Election Cybersecurity (pp. 88-93)

Vulnerabilities arise because of the complexity of modern information technology (IT) systems and human fallibility in making judgments about what actions are safe or unsafe from a cybersecurity perspective. Moreover, cybersecurity is a never-ending challenge. It is unlikely that permanent protections against cyber threats will be developed in the near future given that cybersecurity threats evolve and that adversaries continually adopt new techniques to compromise systems or overcome defenses.

Election Cybersecurity: Cybersecurity and Vote Tabulation (p. 91)

Because there is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats, one must adopt methods that can assure the accuracy of the election outcome without relying on the hardware and software used to conduct the election. Uniform adoption of auditing best practices does not prevent tampering with the results collected and tabulated by computers. It can allow such tampering to be detected and often corrected.

I would clarify that it can only allow such tampering to be detected if there are paper ballots to audit.

Election Cybersecurity: Factors that Exacerbate Cybersecurity Concerns (p. 92)

Changing threat. Traditionally, the goal has been to secure against election fraud by corrupt candidates or their supporters who may attempt to favor a particular candidate by altering or destroying votes or tampering with the vote tally. The 2016 election vividly illustrated that hostile state actors can also pose a threat. These actors often possess more sophisticated capabilities and can apply greater resources to the conduct of such operations. Moreover, they may have other goals than shifting the outcome for a particular candidate.

Specifically they may be seeking to undermine confidence in the election process and systems, which is a different kind of attack than changing an outcome.  Any kind of visible or detectable interference such as defacing websites, Distributed Denial of Service (DDoS), or disclosure of information from within voting systems may achieve the goal of undermining confidence.

Election Cybersecurity: [Consensus] Findings (p. 92-93)

There is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats.

In comparison with other sectors (e.g., banking), the election sector is not following best security practices with regard to cybersecurity.

Even if best practices are applied, systems will not be completely secure.

Foreign state–sponsored attacks present a challenge for even the most responsible and well-resourced jurisdictions. Small, under-resourced jurisdictions are at serious risk.

Better cybersecurity is not a substitute for effective auditing.

I will highlight just one item from the review of End-to-end-verifiability, and I want to make it clear it is a conclusion about voting technology, not about end-to-end verifiability

Complicated and technology-dependent voting systems increase the risk of (and opportunity for) malicious manipulation.

Internet Voting

Internet Voting is covered on pages 101 to 106, including specific examination of Blockchains from pages 103 to 105.  Below are selected extracts only; please read the entire section in the document for the full details.

Internet Voting (pp. 101-106)

Insecure Internet voting is possible now, but the risks currently associated with Internet voting are more significant than the benefits. Secure Internet voting will likely not be feasible in the near future.

Emphasis (bolding) above mine.

Internet Voting: Blockchains (pp. 103-105)

blockchain technology does little to solve the fundamental security issues of elections, and indeed, blockchains introduce additional security vulnerabilities. In particular, if malware on a voter’s device alters a vote before it ever reaches a blockchain, the immutability of the blockchain fails to provide the desired integrity, and the voter may never know of the alteration.

Internet Voting: [Consensus] Findings (p. 106)

The Internet is not currently a suitable medium for the transmission of marked ballots, as Internet-based voting systems in which votes are cast on remote computers or other electronic devices and submitted electronically cannot be made adequately secure today.

The use of blockchains in an election scenario would do little to address the major security requirements of voting, such as voter verifiability. … In the particular case of Internet voting, blockchain methods do not redress the security issues associated with Internet voting.

Internet Voting: Recommendations (p. 106)

5.11 At the present time, the Internet (or any network connected to the Internet) should not be used for the return of marked ballots.35,36 Further, Internet voting should not be used in the future until and unless very robust guarantees of security and verifiability are developed and in place…

35 Inclusive of transmission via email or fax or via phone lines.

36 The Internet is an acceptable medium for the transmission of unmarked ballots to voters so long as voter privacy is maintained and the integrity of the received ballot is protected.

[1] Note: The NASEM defines a consensus report as follows

Consensus Study Report: Consensus Study Reports published by the National Academies of Sciences, Engineering, and Medicine document the evidence-based consensus on the study’s statement of task by an authoring committee of experts. Reports typically include findings, conclusions, and recommendations based on information gathered by the committee and the committee’s deliberations. Each report has been subjected to a rigorous and independent peer-review process and it represents the position of the National Academies on the statement of task.

[2] The report may be cited as e.g.

National Academies of Sciences, Engineering, and Medicine. 2018. Securing the Vote: Protecting American Democracy. Washington, DC: The National Academies Press. doi:10.17226/25120