Tag: e-hääletamine

Estonian ID card vulnerability and upcoming election

On September 5, 2017 the Estonian Information Systems Authority – Riigi Infosüsteemi Ametit (RIA) reported that researchers have found a vulnerability in the Estonian digital ID card:

Possible Security Vulnerability Detected in the Estonian ID-card Chip

This is a serious issue in general, as the card is at the heart of citizen digital interactions with the government, but has particular implications for Internet voting, as the ID card is key to the functioning of the voting system, enabling amongst other features the unique Estonian ability to vote multiple times with only the last vote counting (including choosing to vote in person on election day, cancelling all previous Internet votes).

There are local government council elections coming up soon, with online voting starting in a month, running from 5 October 2017 to 11 October 2017 (online voting is only available for advance polls, not on election day).

Estonia Local Gov Council Elections 2017

above from Municipal council election 2017

According to the Is the ID-card safe? FAQ, the National Electoral Committee (Vabariigi Valimiskomisjon) will decide whether to proceed with online voting.

UPDATE 2017-09-06: In its September 6, 2017 meeting, the National Electoral Committee decided to proceed with online voting in the October elections.  Reported by err.ee – Electoral committee: Online voting in October elections still on / Valimiskomisjon: e-hääletamine toimub.  ENDUPDATE

The analysis of the ID-card vulnerability, by “[a]n international group of cryptography scientists from recognized universities” will be “published in the coming autumn at an international scientific conference” according to the ID-card safety FAQ.

UPDATE 2017-09-06: There’s more detail about the specific vulnerability, which is appears to be a computationally-intensive, technically-challenging way to determine the private key from the security chip, in Postimees article Hackers could have made digital clones / Häkkerid võinuks luua eestlastest digikloonid.  ENDUPDATE

Links in English

Links in Estonian

Additional Context

Original story via Bruce Schneier – Security Flaw in Estonian National ID Card

As Estonia is the only country in the world with national Internet voting, I have written about it many times:

June 16, 2017  evaluation of Predicting the Future – online voting – Estonia
July 8, 2016 Estonian Internet voting and turnout myths
March 8, 2011 Estonian vote-counting system fails
November 11, 2004 e-voting in Estonia

For a perspective on security concerns with the Estonian system that predate the ID card issue, it is also important to read the materials on the website Independent Report on E-voting in Estonia as well as

Updates on Internet voting worldwide

Many things are happening.  Too many things for me to write separate blog posts.  Here’s the situation as of March 8, 2017:

Canada

  • Canadian Parliamentary Special Committee on Electoral Reform recommended against national Internet voting – see December 1, 2016 blog post ERRE Electoral Reform Committee Recommends Against Online Voting
  • Canada’s Minister of Democratic Institutions was directed in her Mandate Letter to defend the Canadian electoral process against cyberthreats – see January 23, 2017 blog post defend Canadian electoral process from cyber threats
  • New Brunswick legislature Commission on Electoral Reform recommended against Internet voting – see March 23, 2017 blog post New Brunswick Internet voting and page 21 of Commission report A pathway to an inclusive democracy
  • Vancouver Independent Election Task Force recommended to city council that Vancouver conduct an online voting pilot, including asking the province to establish an independent technical committee – see slide 17 “Conduct an online voting pilot” of the Task Force presentation to council and pages 27-28 of the Task Force final report
  • Many Ontario municipalities have approved Internet voting for the 2018 municipal elections (far more than this blog can track; it will probably end up being about 200 municipalities)

Everywhere Else