Elections Ontario recommends establishing standards and certification for elections technology

In Ontario, there are no standards in place for choosing, testing, certifying or auditing election technology, including the online voting used in Ontario municipal elections.

This is a huge gap that has opened the door to what is currently basically an unregulated process where individual municipalities choose whether or not to use Internet voting and then procure vendor-based solutions without any guidance.

UPDATE 2022-05-23: The standards committee has been created, see blog post Elections Ontario Advisory Committee on Standards for Voting Technologies.  END UPDATE

It is heartening to see Elections Ontario recognize the gap in standards for voting technology in its Report on Ontario’s 42nd General Election (Modernizing Ontario’s Electoral Process, June 7, 2018).  Elections Ontario makes a long recommendation which I am going to quote in full

Establish common evaluative standards and a certification process for election technology

The Chief Electoral Officer recommends that Ontario establish common evaluative standards and a certification process for technology used in the electoral process in Ontario.

Technology holds a lot of promise for the elections of the future. Increasingly, Ontarians expect that technology will be used to make voting easier, offer more choice to electors for when, where and how to vote, and find efficiencies in the electoral process. Electoral management bodies, including Elections Ontario, are increasingly turning to technology to solve logistical challenges.

In Ontario, the adoption of technology into the electoral process has been done in an ad-hoc way since the late 1980s, and has been led by municipalities. This approach made sense when voting technologies were new and there were no best practices from which to draw. It also allowed municipalities to pioneer technology and discover fit-for-purpose solutions to address their local needs.

With more than 20 years of practical experience at hand, we are at a point where we are actively learning from our past so that we can create best practices and develop future guidelines. Standards can provide consistent guidance for municipalities and the province as we adopt proven technologies using a principled and measured approach.

It is critical that our approach to technology be intentional and evidence-based. Even as the public expects electoral management bodies to find efficiencies through technology, they are also increasingly aware of the possible failures of technology. While there are many benefits to using technology, there are risks involved, as illustrated by recent failures of systems at large organizations.

As the public becomes more informed about software, malware and manipulation of technology data systems, they are increasingly interested in knowing exactly how election technology preserves the integrity of our electoral process and the confidentiality of their personal information. For the public to trust the integrity of the electoral process they must be assured that:

• Technology used to cast a vote will accurately count the vote as intended.
• Technology used to cast a vote will uphold the secrecy of the vote.
• Technology used to tabulate votes will be verifiable and protected from tampering.
• Technology used to transmit election results will be verifiable and protected from tampering.
• Technology will not result in the breach of their confidential and personal information.

To ensure we maintain public trust in our electoral system as we adopt technology, the Chief Electoral Officer recommends that Ontario establish a set of common evaluative standards and guidelines. These will advise election administrators as they consider which technology to adopt, how to evaluate the technology, and the specific technical standards to consider for adopted technology.

This is a very significant step forward for Elections Ontario.  In particular I laud the phrase “It is critical that our approach to technology be intentional and evidence-based.”

There is also a strong statement of principles at the end of the report

We continue to balance making voting easier for Ontarians with the need to preserve the integrity of the electoral process. We want to provide modernized, flexible, and convenient ways to vote, but cannot compromise the core covenants of our democracy: accessibility, one vote per elector, secrecy, integrity and security. As we continue on this modernization journey, these values will continue to be at the centre of the work we do.

As a starting point, the principles above are very good, and to them I would add the implementation criteria from Ontario’s own 2013 report on Alternative Voting Technologies.

Our implementation criteria are:

• Accessibility:
  The voting process is equally accessible to all eligible voters, including voters with disabilities. The voting process will be performed by the voter without requiring any assistance for making their selections.
• Individual verifiability:
  The voting process will provide means for the voter to verify that their vote has been properly deposited inside the virtual ballot box.
• One vote per voter:
  Only one vote per voter is counted for obtaining the election results. This will be fulfilled even in the case where the voter is allowed to cast their vote on multiple occasions (in some systems, people can cast their vote multiple times, with only the last one being counted).
• Voter authentication and authorization:
  The electoral process will ensure that before allowing a voter to cast a vote, that the identity of the voter is the same as claimed, and that the elector is eligible to vote.
• Only count votes from valid voters:
  The electoral process shall ensure that the votes used in the counting process are the ones cast by valid eligible voters.
• Voter privacy:
  The voting process will prevent at any stage of the election the ability to connect a voter and the ballots cast by the voter.
• Results validation:
  The voting process will provide means for verifying if the results clearly represent the intention of the voters that participated in the voting process.
• Service availability:
  The election process and any of its critical components (e.g., voters list information, cast votes, voting channel, etc.) will be available as required to voters, election managers, observers or any other actor involved in the process.

However, those principles need to be refined for a computer-based system, which the report also does

If the implementation of the network voting system does not both support the Chain of Trust and provide auditable evidence, then the process is open to question. This Chain of Trust is a compilation of all the following measures:

1. Source code audit to verify that the code will do only what it is intended to do.
2. Digital signature of the audited source code to protect its authenticity and integrity.
3. Trusted build of the executable code in front of auditors (based on audited source code).
4. Signature of the executable code to protect its authenticity and integrity.
5. Deployment of the executable software in a clean system. Logical sealing of the system to detect any later additions.
6. Logic and accuracy testing of the voting system to validate it works properly.
7. Continuous audit of the voting system during the election, through review and validation of logs and other data. The logs must be protected from external manipulations by using cryptographic measures.
8. Post-election audit that validates that the system behaved correctly by reviewing the logical seals and the protected logs.
9. Individual voter verification that proves their ballots were used in the final tally (by using special receipts).

A strong emphasis must be placed on audit. Independent auditors must be able to review the source code, verify the build and deployment, audit system logs during the election event, and finally to review both the counting process and the results.

Those are strong starting points, and even more so because they emerge from Ontario’s own multi-year research into the subject.
That being said, Ontario also needs to heed the conclusion of the Alternative Voting Technologies report:

At this point, we do not have a viable method of network voting that meets our criteria and protects the integrity of the electoral process.

It is possible that the introduction of standards for municipal online voting could open the door to provincial online voting, and indeed the very-high-level Elections Ontario Strategic Plan 2019 – 2023 (PDF) says

Advance modern elections in a measured and principled manner

• Assess and analyze the environment to inform the modernization of future elections.
• Better understand electors’ needs and behaviours to build modern and responsive services.
• Recommend legislative change to support modernization of electoral services.
• Pilot modernization initiatives through by-elections.

It’s not at all clear what this “modernization” might include.

Conclusion

It is critical that both the current deployment and any potential further expansion of online voting should be subject to extensive analysis by computer security experts.

By applying an evidence-based approach to technology with extensive public, independent, unrestricted testing of election technology, Elections Ontario has the opportunity to move from what it acknowledges has been an ad-hoc approach to one that brings the appropriate levels of standards, testing, certification and auditing in what is a high-risk cybersecurity environment.

Additionally, Elections Ontario needs to close an auditing gap by putting in place risk-limiting audits for the computer vote counting it is now using for provincial elections.  We cannot simply trust the counts produced by the vote tabulators (because computers can be programmed to produce whatever result the programmer wants); we must have a public audit to increase the confidence in the results.

I hope that municipalities and the provincial government will accept that putting standards in place may result in the decertification and withdrawal of voting technology, as has happened when “electronic voting machines” were examined in the United States and when Switzerland made one of its online voting solutions available for public testing.

Open Source code and Canadian elections

Here’s what I wrote in response to some confusion about Canadian elections in the comments on Schneier on Security blog post DARPA Is Developing an Open-Source Voting System

Sfan and Earnest – In response to Sfan’s statement “FWIW, Elections Canada used a paper & marker ballot system and a human & paper based voter validation system until 2015.”

Elections Canada runs federal elections only, and continues to use hand-marked paper ballots that are hand counted. See e.g. https://twitter.com/ElectionsCan_E/status/1105136418639233024

You might be confusing Elections Canada with Elections ONTARIO, which has recently switched from hand-counted ballots to vote counting computers for provincial elections. With, I might add, zero provision for risk-limiting audits.

Municipal elections in Ontario, which are governed by provincial election law, use a mix of vote counting computers (as in the City of Ottawa) and completely unregulated Internet voting. Internet voting run by third-party for-profit companies with zero public availability of source code, zero public security testing, and no legislative provisions for either.

In terms of the substance of Schneier’s blog post, there are also some issues. He quotes

The system will use fully open source voting software, instead of the closed, proprietary software currently used in the vast majority of voting machines, which no one outside of voting machine testing labs can examine. More importantly, it will be built on secure open source hardware, made from special secure designs and techniques developed over the last year as part of a special program at DARPA [Defense Department’s Defense Advanced Research Projects Agency].

(Emphasis on special mine.)

Issues to consider:

• Open source is better (because it can be inspected) but ultimately useless as a voting computer improvement because you cannot prove what code is running on a computer.
• In theory you can address the issue of what code is running by having secure hardware but there is no perfect hardware security, just like there is no perfect software security.  Additionally, election security is about universally understandable verifiability.  Any citizen should be able to understand the election process and the results.  “Trust us, this special hardware is secure” is no different than “trust us while we go in this special locked room and secretly produce the election results”.
• Similarly, in theory you can use cryptographic techniques to improve the security and verifiability of the election, but the only people who can actually understand them is a tiny set of cryptographers.  To everyone else you’re saying “trust us, this special crypto code is secure” which is no different than “trust us while we go in this special locked room and secretly produce the election results”.

Having open source is better, having public inspection and testing of the code is better, having verified cryptography is better, but none of these improvements to computer vote counting address the fundamental issue which is that you can’t do computer vote counting in a way that is transparently understandable by every voter, and so you shouldn’t be doing computer vote counting at all.

Plus which, in practice you can’t tell what code is running on a computer anyway, because computers can lie.  Computer programs are written by people; people can lie, and so they can tell computers to lie.  You can ask the computer “are you running this open source code” and the computer can say “oh yes, absolutely” even as it triggers the hidden election day malware that slightly alters votes just enough to tip the result to a different candidate.

At most, when you have very complicated ballots as in the US you can consider doing computer vote counting with hand-marked paper ballots and a risk limiting audit.  But for Canada’s extraordinarily simple elections, computer vote counting adds needless complexity, obscurity and risk to an already optimised system.

That being said, if we are stuck with Internet voting in Canadian municipal elections, open source code and public security testing is absolutely essential, as much because it will demonstrate repeatedly that the source code is both ridiculously complicated and insecure, as for the fact that it helps reduce (but definitely not eliminate) security risks.

In other words, open source and public security inspections are only about making something we shouldn’t be doing in the first place less terrible.  They are not an actual solution.  The actual solution is not to have Internet voting and computer vote counting at all in Canadian elections.

New South Wales Australia invites Internet voting source code review under restrictive conditions

Here’s the good news:

The NSW Electoral Commissioner is inviting requests from individuals who have a private or academic interest and expertise in electronic voting, or a related field, to review aspects of the iVote system source code prior to the NSW State election in March 2019.

and here’s the fine print which turns this into an extremely restricted, private review of secret code:

The following conditions will also apply to any application made, or access granted, to review the iVote voting system source code:

• The iVote Voting System source code supplied to the NSW Electoral Commissioner by [for-profit Internet voting company] will only be available for review by an individual on the NSW Electoral Roll or the Australian Electoral Roll.

• The details of each review application received by the Commissioner will be shared with [for-profit Internet voting company], and may also be shared with third parties to enable the Commissioner to establish the identity and expertise of an applicant.

• The Commissioner may request the applicant to provide additional material in support of their application.

• Any successful applicant will be required to sign a Deed of Confidentiality and Privacy with both the NSW Electoral Commission and with [for-profit Internet voting company] before accessing any components of the source code for review.

• The Commissioner and [for-profit Internet voting company] reserve the right to refuse any application, including (without limitation) where an applicant works for a competitor of [for-profit Internet voting company], where an applicant is unable to demonstrate to the satisfaction of the Commissioner sufficient expertise in electronic voting or a related field, or where the Commissioner considers it is not in the public interest to grant access in a particular case or in general.

So just to summarize what this is not:

• This is not open source or public source code.
• This is not an independent review.  The reviewers must be known to [for-profit Internet voting company] and must be approved by them.
• This is not a global review – you must be from Australia.
• There will be no independent reporting on the results of the review.  The Deed of Confidentiality and Privacy will almost certainly ensure that any and all results are held in secret by the NSW Electoral Commission and [for-profit Internet voting company] and that any reporting will be through their approved and almost certainly anodyne press releases.

Basically they’re asking you to do a code review (probably for free) out of some sense of public duty.  And you only get to do the review if they decide you’re “worthy”, under criteria that they control.  And the results of your review will be secret.  While this is a good PR exercise for them, and certainly more-secure code is better than less-secure code, almost all the benefits accrue to [for-profit Internet voting company].

Securing the Vote – US National Academies 2018 consensus report

The US National Academies of Sciences, Engineering and Medicine (NASEM) uses a comprehensive study process http://www.nationalacademies.org/studyprocess/ to ensure high standards of scientific and technical quality.

On September 6, 2018 they released their 2018 consensus report

Securing the Vote: Protecting American Democracy

The report is available to download as a PDF (login isn’t required, you can download as a guest) and is also posted to read online.  (See blog note 1 for the definition of a consensus report.)

The key conclusions highlighted in the introduction to the release are:

All U.S. Elections Should Use Paper Ballots by 2020 …; Internet Voting Should Not Be Used at This Time

Emphasis (bolding) above mine.

Ensuring the Integrity of Elections

Chapter 5: Ensuring the Integrity of Elections contains many sections relevant to voting technology.  Below are selected extracts only; please read the entire chapter for the full details.

Malware (pp. 86-87)

Malware can be introduced at any point in the electronic path of a vote—from the software behind the vote-casting interface to the software tabulating votes—to prevent a voter’s vote from being recorded as intended.

Maintaining Voter Anonymity (pp. 87-88)

With remote voting—voting outside of publicly monitored poll sites—it may not be difficult to compromise voter privacy. When voting, for example, by mail, fax, or via the Internet, individuals can be coerced or paid to vote for particular candidates outside the oversight of election administrators.

Election Cybersecurity

Election Cybersecurity (pp. 88-93)

Vulnerabilities arise because of the complexity of modern information technology (IT) systems and human fallibility in making judgments about what actions are safe or unsafe from a cybersecurity perspective. Moreover, cybersecurity is a never-ending challenge. It is unlikely that permanent protections against cyber threats will be developed in the near future given that cybersecurity threats evolve and that adversaries continually adopt new techniques to compromise systems or overcome defenses.

Election Cybersecurity: Cybersecurity and Vote Tabulation (p. 91)

Because there is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats, one must adopt methods that can assure the accuracy of the election outcome without relying on the hardware and software used to conduct the election. Uniform adoption of auditing best practices does not prevent tampering with the results collected and tabulated by computers. It can allow such tampering to be detected and often corrected.

I would clarify that it can only allow such tampering to be detected if there are paper ballots to audit.

Election Cybersecurity: Factors that Exacerbate Cybersecurity Concerns (p. 92)

Changing threat. Traditionally, the goal has been to secure against election fraud by corrupt candidates or their supporters who may attempt to favor a particular candidate by altering or destroying votes or tampering with the vote tally. The 2016 election vividly illustrated that hostile state actors can also pose a threat. These actors often possess more sophisticated capabilities and can apply greater resources to the conduct of such operations. Moreover, they may have other goals than shifting the outcome for a particular candidate.

Specifically they may be seeking to undermine confidence in the election process and systems, which is a different kind of attack than changing an outcome.  Any kind of visible or detectable interference such as defacing websites, Distributed Denial of Service (DDoS), or disclosure of information from within voting systems may achieve the goal of undermining confidence.

Election Cybersecurity: [Consensus] Findings (p. 92-93)

There is no realistic mechanism to fully secure vote casting and tabulation computer systems from cyber threats.

…

In comparison with other sectors (e.g., banking), the election sector is not following best security practices with regard to cybersecurity.

…

Even if best practices are applied, systems will not be completely secure.

Foreign state–sponsored attacks present a challenge for even the most responsible and well-resourced jurisdictions. Small, under-resourced jurisdictions are at serious risk.

…

Better cybersecurity is not a substitute for effective auditing.

I will highlight just one item from the review of End-to-end-verifiability, and I want to make it clear it is a conclusion about voting technology, not about end-to-end verifiability

Complicated and technology-dependent voting systems increase the risk of (and opportunity for) malicious manipulation.

Internet Voting

Internet Voting is covered on pages 101 to 106, including specific examination of Blockchains from pages 103 to 105.  Below are selected extracts only; please read the entire section in the document for the full details.

Internet Voting (pp. 101-106)

Insecure Internet voting is possible now, but the risks currently associated with Internet voting are more significant than the benefits. Secure Internet voting will likely not be feasible in the near future.

Emphasis (bolding) above mine.

Internet Voting: Blockchains (pp. 103-105)

blockchain technology does little to solve the fundamental security issues of elections, and indeed, blockchains introduce additional security vulnerabilities. In particular, if malware on a voter’s device alters a vote before it ever reaches a blockchain, the immutability of the blockchain fails to provide the desired integrity, and the voter may never know of the alteration.

Internet Voting: [Consensus] Findings (p. 106)

The Internet is not currently a suitable medium for the transmission of marked ballots, as Internet-based voting systems in which votes are cast on remote computers or other electronic devices and submitted electronically cannot be made adequately secure today.

…

The use of blockchains in an election scenario would do little to address the major security requirements of voting, such as voter verifiability. … In the particular case of Internet voting, blockchain methods do not redress the security issues associated with Internet voting.

Internet Voting: Recommendations (p. 106)

5.11 At the present time, the Internet (or any network connected to the Internet) should not be used for the return of marked ballots.^35,36 Further, Internet voting should not be used in the future until and unless very robust guarantees of security and verifiability are developed and in place…

³⁵ Inclusive of transmission via email or fax or via phone lines.

³⁶ The Internet is an acceptable medium for the transmission of unmarked ballots to voters so long as voter privacy is maintained and the integrity of the received ballot is protected.

[1] Note: The NASEM defines a consensus report as follows

Consensus Study Report: Consensus Study Reports published by the National Academies of Sciences, Engineering, and Medicine document the evidence-based consensus on the study’s statement of task by an authoring committee of experts. Reports typically include findings, conclusions, and recommendations based on information gathered by the committee and the committee’s deliberations. Each report has been subjected to a rigorous and independent peer-review process and it represents the position of the National Academies on the statement of task.

[2] The report may be cited as e.g.

National Academies of Sciences, Engineering, and Medicine. 2018. Securing the Vote: Protecting American Democracy. Washington, DC: The National Academies Press. doi:10.17226/25120