Questions about the reliability of i-voting

Voting procedures

1. How has i-voting influenced voter turnout?

Introduction of i-voting has not had a significant impact on voter turnout. The greatest impact on voter turnout has been in voting in foreign states. Around one third of the voters have decided to use the new voting method or i-voting, and the researchers have found that the voters who i-vote are likely to participate also in the next elections.

2. How is the voter identified?

In Estonia, it is possible to identify the voter reliably in the i-voting system on the basis of a nationally issued identification document, which may be an ID-card, digi-ID or mobile ID.

3. How is it ensured that each voter votes himself or herself (independently)?

I-voting does not take place in a controlled environment, like a polling place. In order to ensure that the voter expresses their will freely, they always have the possibility to choose a suitable time and place for i-voting. If the voter could not vote freely, the electronic vote given may be changed by voting online again during advance polls, or by voting at the polling station during the days of advance voting. In such a case, the last i-vote cast or the vote given at the polling place is taken into account A voter may not change their vote on the election day.

4. How is vote buying / transfer of ID-card and its codes prevented?

Buying of i-votes is a crime, like all other forms of vote buying. If it is suspected, the police will deal with it. Vote buying is punishable under § 162 of the Penal Code, pursuant to which the punishment is a pecuniary punishment or imprisonment. Transfer of ID-card and its codes is prohibited; each person is responsible for safeguarding their digital identity.

5. Why is it possible to change your i-vote, but not the paper vote?

The purpose of the possibility of changing of an i-vote is the freedom of voting, which means that the voter who thinks they could not vote freely or dies not trust their computer can vote again. Thus, the reason behind this is not giving the possibility to change one’s preference, but ensuring the freedom of voting. At the elections with paper ballot, it is technically impossible because the ballot paper cannot be taken out of the ballot box.

6. Why is it not possible to vote with a smart device?

It may be possible to conduct elections with the help of smart devices in the future. However, it would require several additional platforms (incl. different versions of operating systems), for which relevant applications have to be created. This will make the whole system significantly more complicated, increase security risks and price – and at the same time, the users of smart devices are generally also users of computers, and already have the possibility to vote on a computer.

During the voting process, a smart device can be used for verifying the vote, which enables to check if the computer used for voting behaved correctly and the vote reached the server as planned.

7. How is the secrecy of i-voting ensured?

Voter application encodes (encrypts) the voter’s vote with the public key on such a way that in forwarding the vote, it is not possible to see for whom the voter voted. Before the counting of votes, the i-voting system separates the voter’s personal data from the votes given. The votes can be opened only with a secret key, the access to which is divided between the members of the National Electoral Committee. More than half of the members of the National Electoral Committee have to be present for opening of the votes.

 

Estonia and the rest of the world

8. Why did Estonia decide to introduce i-voting?

Estonia decided to introduce i-voting in order to make participation in elections more convenient for people, so that voting would not depend on time and place. This decision was supported by the technological base and the readiness of the society.

9. Why is i-voting used only in Estonia and not in other countries?

The Estonian i-voting system is based on the fact that the Estonian ID-card has been an official document for establishing the identity of a person for more than a decade. Most countries do not have such an extensively used digital system for identification and verification. Besides technological solutions, it is also necessary to have a legislative basis and political will.

10. Which countries use voting through the Internet?

One of the characteristic features of Switzerland is the high confidence of its citizens in their state, which has several times allowed to experiment with different technologies of e/i-voting in several cantons. By today, the government has essentially replaced the widespread (used by 80%) system of advance postal voting by an i-voting system. Materials for authentication and verification are sent each time by mail.

In Canada, i-voting is used at local elections. It differs by local governments, because it is decided at the local level which voting methods are used.

11. Which countries have tried i-voting?

In Norway, online voting was used for the first time in ten local governments at the local elections of 2011. At the parliamentary elections of 2013, it was possible to use online voting in 12 local governments. The experiment ended when a political party opposing i-voting got in power.

Several other countries have experimented with different methods of i-voting, like the USA (in the states of Arizona and Utah), France, Great Britain, Catalonia, India (State of Gujarat). But all these have remained experiments because the issues of electronic registration and authentication of voters have not yet been solved in these countries.

12. Why have other countries discontinued their i-voting projects?

The reasons have been different, there are several technological issues that have not been solved yet. They do not have the infrastructure Estonia has (e-ID, electronic registration of voters), and the political decisions have an impact.

13. What is the international reaction to Estonia’s i-voting solutions?

The international reaction is generally positive - every year dozens of journalists and delegations from different countries come to Tallinn to study how Estonia has developed its system. It is necessary to explain internationally the history of the Estonian ID-card and the system of digital identity documents, and it is important to underline that the Estonian system is not the same as election machines, voting by e-mail or other such things. In all these years, we have also received criticism. All useful comments have been taken into consideration to improve the system further in the future.

14. But the international experts have found that the system is not reliable, e.g., there has been criticism from the OSCE?

The elections managers take the recommendations of international experts very seriously. The OSCE has carried out two full-scale observation missions focusing on i-voting. As a result of these missions, several proposals were made for improving the system, but it was never found that the system was not secure.

As it is not possible to compare the Estonian solution with similar solutions in other countries, the criticism of experts (e.g. Halderman) is often based on the issues that have already been solved in Estonia.

15. Can i-voting be secure if internationally several elections (USA, Netherlands) have been “hacked”?

In both cases, the voting systems were not hacked – in one case, the e-mail servers were broken in, and in the other case, there was a software error in the vote forwarding system.

The security of Estonian i-voting is to a great extent ensured by the fact that the infrastructure necessary for its functioning (cards, readers, software) is not designated specially for election time, but is used daily in work procedures, banking, etc. If the Estonian electronic way of life had major technological security holes, it would have made it possible to destroy our whole banking system a long time ago, not to speak of the general functioning of the state – we do not even have enough service counters left. I-voting in Estonia is just one of the many e-services provided by the government. Therefore we can presume that possible technological errors will be detected during the main use, which is not i-voting. This in its turn brings along a sense of security that the change of operative situation during the elections is both monitored and noticed.

 

Results of i-voting

16. How can the voter be sure that their vote reached the i-voting system correctly?

With the help of a verifying application that can be downloaded to a smart device, each voter can check if the vote that reflects their will has reached the i-vote collector correctly. If the vote is not the same, the voter should contact the customer service immediately. The vote can be checked during thirty minutes up to three times.

17. How can you be sure that all collected i-votes are counted correctly and the voting result is right?

Data auditors and each observer who has passed relevant training can check the correct functioning of the system.

The conformity of votes collected, votes to be counted and votes counted is checked by mathematical means within the framework of data audit, to confirm the correct functioning of the process.

18. Why are the i-votes destroyed so quickly after the declaration of election results?

Pursuant to the law, the votes have to be preserved for the period when all complaints have been reviewed and solved and the election results have been declared. Only after that, both the i-votes (to be more exact, the key for opening the i-votes) and the paper ballots are destroyed. Declaration of election results means that all parties have accepted the result and after that, no disputes will be opened.

19. How is it possible that voters of advanced age vote as actively as the young?

In Estonia, the ID-card is used for carrying out everyday transactions; all things necessary for life can be managed with the help of it. Even the aged know how to use the ID-card and the computer. And the number of the aged among the i-voters grows year by year.

References

I-voting statistics

20. Does i-voting favour specific political parties?

Kristjan Vassil and Mihkel Solvak, researchers at the University of Tartu, have reached the conclusion in their works that i-voting does not favour specific political parties. No political party gets an advantage at the elections just because part of the voters for that party decided to use another method of voting. They would most probably vote for that political party also without the possibility of i-voting, but if they have been given that possibility, they use it.

21. What use is the implementation of i-voting to the voters and to the society?

I-voting is a convenient way for participating in the elections and having your say in the society.   Even those who are travelling or in another country can take part in the elections – for example, at the Riigikogu elections of 2015 there were i-votes from 116 countries across the world. I-voting also saves expenses, and the most important thing is not saving on the organisational costs of elections, but that the time and money of the voters are saved instead. The research conducted during the parliamentary elections of 2011 shows that more than half a million euro was saved.

 

Miscellaneous

22. How can i-voting be observed?

Everybody who is interested can observe i-voting. An observer can observe all observable activities of i-election managers. For that, the documentation of the i-voting system has been published beforehand. Before the beginning of i-voting, the State Electoral Office will organise a training for observers.

23. Who are the organisers of i-voting? Can they be trusted?

I-voting is organised by the State Electoral Office in cooperation with the Information System Authority. An employee of the State Electoral Office is the manager of i-voting. The National Electoral Committee is in charge of the organisational matters and exercises supervision over all i-voting activities.

24. Can the voter’s computer be trusted?

The voter has to take care that their computer is virus-free and that all activities for conducting of i-voting are ensured. The software in the voter’s computer should be updated and secure also during the period between the elections.

25. What is the difference between i-voting and e-voting?

There is a specific difference in the English language – i-voting and e-voting. The system used in Estonia is called i-voting in English. Thus, i-voting is what is used in Estonia: we have the mandatory identification document and two codes, one for identifying oneself and the other for signing of documents. E-voting is the term mainly used for describing the kiosk-type system.

26. How can it be ensured that a person votes with their own certificates?

In order to i-vote, a person needs the personal certificates in the ID-card. They were issued with the ID-card. The i-vote collecting server recognises only the certificates issued by the SK persona certificates division. The cryptographic material with the help of which a person (on the basis of their certificate) gives their i-vote in permanently located in the ID-card and cannot be exported or copied from there.

27. How can I be sure that the authentication and signature keys connected with my personal certificate have not leaked?

When the ID-card is issued, these keys are generated in the card and there is no copy of the private keys anywhere else. This request ensures that only the owner of the ID-card can use it.

28. How can I be sure that the electoral committee or anybody else cannot change the contents of the vote-collecting tank?

The content of votes is doubly protected. First, the vote (in an envelope) is attached the person’s digital signature, and no bit of the signature can be changed without identification. The vote itself is encrypted, and there is only one copy of the key necessary for decrypting, located in a secure device, which is switched on only after the advance and main voting are finished.

During transmission, the encrypted vote gets a time stamp from the provider of registration service. This enables to check if all votes sent have been received by the vote collector and forwarded for counting.

29. Why is it not possible to submit an invalid ballot at i-voting?

The legislator has given instructions to the electoral committee on how to behave with an invalid ballot that has been generated by mistake if such a situation should arise. As cryptography ensures the integrity of message in the digital world, an invalid ballot can emerge only intentionally, as a result of the efforts made by a person. The person has to actively fight against the verification mechanisms of the voting server in order to submit an invalid ballot.

30. Why should we presume that a person themselves does not want to cheat with their ID-card?

In Estonia, eID is used not only during elections, but also in everyday life. Conducting everyday transactions and concluding agreements with the help of ID-card ensures feeling of security, as the people can see that eID technology is secure and there are no frauds or court actions.

Transfer of your ID-card and PIN codes, and using another person’s identity document in any way is illegal. Voting as another person means that several crimes are committed at the same time: an identity crime, a crime connected with misuse of a document and an election crime.

 

Security of i-voting

31. Is it safe to vote over the Internet?

I-voting is as reliable and secure as voting in the traditional way. I-voting has taken place since 2005, and the measures to guarantee security have been constantly improved. The following is a brief overview of some more important aspects of security.

Since 2013 elections, the voter has the possibility to check if their vote has reached the elections server. Checking of the vote by the voter is a new instrument that enables to verify that the voter’s computer behaves correctly and no malware that may disturb i-voting has been installed there. 

Monitoring the work of central voting servers, observing and the audit conducted by independent auditors are the security measures ensuring that i-votes are stored and counted in a correct way.

The starting point for the construction of the i-voting system was that voting over the Internet should be as reliable as possible. Therefore, it is necessary that the voter identifies themselves with an ID-card or mobile-ID, and does not use any other, less secure solutions for identification. The structure of the i-voting system ensures that nobody can find out whom the voter voted for.

Security is also increased by the fact that the functioning of the i-voting system can be followed and monitored by the observers. In July 2013, the source code of i-voting system software was made public for examination and studying to all who are interested via the elections web page.

32. How is the secrecy of my vote kept if I can see in my smartphone who I voted for?

For more information, read:  Checking of vote with a smart device

33. Why don’t other countries use voting over the Internet at national elections?

In Estonia, we have for more than a decade had an official identification document, the ID card, which enables the identification of persons over the Internet. Other countries do not have such an identification system.