System of voting in government elections via the Internet in Estonia
"i-voting" redirects here. For the broader concept, see Internet voting.
Electronic voting in Estonia gained popularity in 2001 with the "e-minded" coalition government. In 2005, it became the first nation to hold legally binding general elections over the Internet with their pilot project for municipal elections.[1] Estonian election officials declared the electronic voting system a success and found that it withstood the test of real-world use.[2]
The term Power voting (or e-voting) can refer to both fixed voting locations (as in voting booths) and remote (as in over the Internet) electronic voting. To reduce confusion between the two, electronic voting is known as i-Voting in Estonia. The security model is modeled after the way in which advance voting and postal voting is handled.[5]
The Estonian internet voting system builds on the Estonian ID card. The card is a regular and mandatory[6] national identity document as well as a smart card, allowing for both secure remote authentication and legally binding digital signatures using the Estonian state supported public key infrastructure.[7] As of March 2007, over 1.08 million cards have been issued (out of the Estonian population of 1.32 million).[8]
Remains of disks destroyed by Electoral Committee in 2013
Internet voting is available during an early voting period (four to six days prior to Election Day). Voters can change their electronic votes an unlimited number of times, with the final vote being tabulated. Anyone who votes using the Internet can vote at a polling station during the early voting period, invalidating their Internet vote. It is possible to change the electronic vote on Election Day since 2021.[9] Votes are counted on Election Day after polling stations are closed and storage media containing the votes are physically destroyed after all election complaints are resolved at least one month after elections.
A cost-efficiency comparison of the different voting channels offered in the Estonian Municipal Elections (2017) concluded that Internet voting is the most cost-efficient voting channel offered by the Estonian electoral system.[10]
The principle of "one person, one vote" is maintained, as the voter is able to cast more than one ballot, but only one vote is ultimately recorded. This assertion was challenged in August 2005 by Arnold Rüütel, then President of Estonia, who saw the new e-voting provisions in the Local Government Council Election Act as a breach of the principle of equality of voting. The President petitioned against the e-voting provisions to the Supreme Court of Estonia but lost.[11]
Transparency and verifiability
According to the recommendations of OSCE/ODIHR election observers, and because of a voting client hacking case brought to the Supreme Court in 2011, Estonia implemented vote verification for individual voters in 2013. Voters verify their ballots by using a smartphone application which uses a QR code displayed by the desktop voting client to display the candidate for whom the vote was cast. Individual verification verifies that the vote cast was stored on the vote collection server for not more than either 30 or 60 minutes, depending on the election. The voter cannot directly verify that the vote was also tallied as cast.
The voting system's serverside source code was published in June 2013 because of social pressure initiated by Tanel Tammet, a computer scientist who coauthored research papers from 2001 on electronic voting requirements. The source code was published on GitHub and has been available for all subsequent elections. Neither the voting client's source code nor the reference code have been published, as election officials have determined that this would allow malicious actors to build fake voting clients. Because the voting protocol is public, anyone can build a voting client.
In 2015, extensive reports from OSCE/ODIHR election observers and an independent observing team led by J Alex Halderman in 2015, as well as public pressure from local activists, motivated the implementation of universal vote tally verifiability in 2017. Tally verification is done by mixnet, making use of homomorphic properties and elGamal encryption provided by Douglas Wikström. Universal tally verification is not a mandatory part of the process, and is conducted by a dedicated data auditor. Tallying the votes with mixnet is done in parallel with plain text extraction of the votes from encrypted envelopes, which are decrypted using the voting commission's secret key and from which the digital signatures of voters are removed.
Although a white paper on Estonia's 2017-2019 implementation of its electronic voting system claims that the system permits end-to-end verifiability, this has been denied by independent researchers.[12] A working group was formed by Minister of Foreign Trade and Information TechnologyKert Kingo in order to assess the "verifiability, security and transparency" of electronic voting. The group produced a report consisting of 25 improvement proposals, of which[13] proposals 11, 13 and 25 pertain to the system's problems with verifiability.[14] The government coalition agreement also asserts the need for independent international auditing of the system.
Criticism
Despite praise from Estonian election officials, computer security experts from outside the country who have reviewed the system have criticized it, warning that any voting system that transmits ballots electronically cannot be secure.[15] This criticism was underscored in May 2014, when a team of international computer security experts released their examination of the system, claiming they could breach the system, change votes and vote totals, and erase all evidence of their actions if they were to install malware on Estonian election servers.[16] The team advised the Estonian government to halt all online voting because of the potential threats that it posed to their government.
The Estonian National Electoral Committee reviewed the concerns and published a response, saying that the claims "give us no reason to suspend online balloting". The purported vulnerabilities were said to be either infeasible in reality or already accounted for in the design of the e-voting system.[17] The Estonian Information System Authority also responded to the claims, describing them as a political, rather than technical, attack on the e-voting system, and criticizing the method of disclosure.[18] The researchers' connection to the Estonian Centre Party, which has long been critical of e-voting, has also been a common speculation among Estonian state officials and has been even suggested by a prime minister.[19][20][21]
The main author of a white paper on Estonian electronic voting from 2001, Helger Lipmaa[et],[22] has been critical of the system, and uses paper ballots to cast his own votes.[23] The main author of the second white paper on Estonian electronic voting from 2001, Tanel Tammet,[24] has been campaigning for the opening of the system's source code and for the implementation of independent parallel systems to guarantee trust in the e-voting system.[25][26] The serverside code was published under the Creative Commons BY-NC-ND license on GitHub as a result of those efforts in July 2013.[27]
The OSCE/ODIHR election observation mission has voiced concerns about Estonian e-voting during every parliament election, initially proposing in 2007 that e-voting be suspended if its problems remain unaddressed,[28] then suggesting in 2011 that the election commission should create an inclusive working group for improving e-voting and that cryptographic measures should be implemented to ensure that voting is observable[29][30] and noting that the verification features implemented for the 2015 elections only partially address their previous recommendations.[31]
In a 2012 overview of international e-voting implementations, IFES independent researchers found that, although insofar successful, in situation of "emerging international electoral standards with respect to Internet voting" Estonian voting system faces necessary improvements for "better legislation, a transparent policy and formalized procedures" as well as "broader democratic goals, such as enhancing civic e-participation" need to be considered.[32]
In 2013 Free Software Foundation Europe criticized partial publishing of the source code of e-voting system and for using non-software licenses for publication. FSFE also suggests researching into solutions that lessen reliance on system administrators and instead build the system on cryptographic models of trust. Since the weakest part of voting infrastructure is voter's computer, FSFE suggests Estonia should mitigate the risks of unnoticed subversion of votes in compromised client machines and "publicise the dangers as widely as possible, along with instructions to minimise the risk and rectify the situation should a risk realise".[33]
There have been also attempts to expose problems of voting system by proofs of concept. In 2011 Paavo Pihelgas created a trojan that was theoretically able to change voter's choice without user noticing. He used this as basis for filing an election complaint and demanded that Supreme Court invalidates election results. The court dismissed the case because Pihelgas's "voter's rights had not been infringed as long as he had knowingly put himself into the situation".[34][35]
In 2015, an activist from the Estonian Pirate Party, Märt Põder, took credit for casting an invalid ballot "using a GNU debugger to locate the breakpoint in Linux IVCA where the candidate number is stored and replace it with an invalid candidate number".[36] Being only one among 176,491 e-voters to do it, the activist explained to the media that client application source code should be opened up and taught as part of general education in public schools to make people trust e-voting.[37] Later negotiating with electoral commission, an activist went on to stress that end-to-end verifiability is a prerequisite for reliable e-voting, and that the whole process of planning, procuring and implementing e-voting should be conducted in English as well, which opens up to the international community for proper scrutiny.[38][39]
In 2016, computer scientists at the University of Oxford, while acknowledging relative success of conducting e-voting, they claimed that e-voting system officials "have relied since the system's inception on building trust through interpersonal relations," and that "may work well for a close-knit society such as that of Estonia". However, "informal processes (including lessons learned) should be further clarified and formally documented".[40]
In beginning of June 2019, Kert Kingo, Minister of Foreign Trade and Information Technology of the newly elected government created an inclusive working group to assess the "verifiability, security and transparency"[41][42] of the Estonian electronic voting system. The working group consisted of state officials, representatives from universities and research institutes, critics, and creators of the system.[43][44] In December 2019 they presented results of the six-month investigation, with 25 proposals for improving the core infrastructure of the Estonian e-voting system.[13]
History
2019 election, Most voted-for party by counties and city districts, excluding electronic voting (43.8% of all votes): ReformCentreConservative People's2019 election, Most-voted for party (electronic voting) by electoral district: ReformCentre
2023 elections
With 312,181 electronic votes, these were the first elections in history where more than half of the votes (51.1%) were cast online.[46]
After the publication of the e-vote results, Martin Helme, the leader of EKRE, stated that "he does not trust the e-vote results" and demanded a recount.[47]
In the European Parliament elections, 155,521 people voted over the Internet. This means that roughly 46.7% of participating voters gave their vote over the Internet.[49]
2017 elections
In the 2017 local municipal elections, 186,034 people voted over the Internet. This means that roughly 31.7% of participating voters gave their vote over the Internet.[50]
In the European Parliament elections, 103,151 people voted over the Internet. This means that roughly 31.3% of participating voters gave their vote over the Internet.[51]
2013 elections
In the 2013 local municipal elections, 133,808 people voted over the Internet.[52] This means that roughly 21.2% of participating voters gave their vote over the Internet.[51] It was also the first election where vote verification with mobile device was implemented. [53]
2011 elections
In the 2011 parliamentary elections, 140,846 people voted over the Internet. This means that roughly 15.4% of the persons with the right to vote and 24.3% of participating voters gave their vote over the Internet.[51] It was also the first election to allow for voting through chip-secure mobile phones, following a law approved by Parliament in 2008.[54]
2009 elections
In the 2009 local municipal elections, 104,415 people voted over the Internet.[55] This means that roughly 9.5% of the persons with the right to vote gave their vote over the Internet.[56]
In the European Parliament elections, 58,669 people voted over the Internet. This means that roughly 14.7% of participating voters gave their vote over the Internet.[51]
2007 elections
In 2007 Estonia held its and the world's first general elections with Internet voting available from February 26 to 28. A total of 30,275 citizens used Internet voting (3.4%), which means for every 30 eligible voters one of them voted through the Internet.[57]
2005 elections
In 2005 Estonia became the first country to offer Internet voting nationally in local elections.[58] 9,317 people voted online (1.9%).
Related Research Articles
David Lee Chaum is an American computer scientist, cryptographer, and inventor. He is known as a pioneer in cryptography and privacy-preserving technologies, and widely recognized as the inventor of digital cash. His 1982 dissertation "Computer Systems Established, Maintained, and Trusted by Mutually Suspicious Groups" is the first known proposal for a blockchain protocol. Complete with the code to implement the protocol, Chaum's dissertation proposed all but one element of the blockchain later detailed in the Bitcoin whitepaper. He has been referred to as "the father of online anonymity", and "the godfather of cryptocurrency".
A voting machine is a machine used to record votes in an election without paper. The first voting machines were mechanical but it is increasingly more common to use electronic voting machines. Traditionally, a voting machine has been defined by its mechanism, and whether the system tallies votes at each voting location, or centrally. Voting machines should not be confused with tabulating machines, which count votes done by paper ballot.
Electronic voting is voting that uses electronic means to either aid or take care of casting and counting ballots including voting time.
Electoral fraud, sometimes referred to as election manipulation, voter fraud, or vote rigging, involves illegal interference with the process of an election, either by increasing the vote share of a favored candidate, depressing the vote share of rival candidates, or both. It differs from but often goes hand-in-hand with voter suppression. What exactly constitutes electoral fraud varies from country to country, though the goal is often election subversion.
Vote counting is the process of counting votes in an election. It can be done manually or by machines. In the United States, the compilation of election returns and validation of the outcome that forms the basis of the official results is called canvassing.
An absentee ballot is a vote cast by someone who is unable or unwilling to attend the official polling station to which the voter is normally allocated. Methods include voting at a different location, postal voting, proxy voting and online voting. Increasing the ease of access to absentee ballots is seen by many as one way to improve voter turnout through convenience voting, though some countries require that a valid reason, such as infirmity or travel, be given before a voter can participate in an absentee ballot. Early voting overlaps with absentee voting. Early voting includes votes cast before the official election day(s), by mail, online or in-person at voting centers which are open for the purpose. Some places call early in-person voting a form of "absentee" voting, since voters are absent from the polling place on election day.
Voter verifiable paper audit trail (VVPAT) or verified paper record (VPR) is a method of providing feedback to voters using a ballotless voting system. A VVPAT is intended as an independent verification system for voting machines designed to allow voters to verify that their vote was cast correctly, to detect possible election fraud or malfunction, and to provide a means to audit the stored electronic results. It contains the name of the candidate and symbol of the party/individual candidate. While it has gained in use in the United States compared with ballotless voting systems without it, it looks unlikely to overtake hand-marked ballots.
Elections in Kazakhstan are held on a national level to elect a President and the Parliament, which is divided into two bodies, the Majilis and the Senate. Local elections for maslihats are held every five years.
Secure Electronic Registration and Voting Experiment (SERVE) was an experiment by the Federal Voting Assistance Program (FVAP) to allow military personnel and overseas citizens covered by the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) to vote in elections in the United States via the Internet. While called an experiment, SERVE included participation from 51 counties including up to 100,000 voters and ballots cast would have been counted toward actual election results. According to the SERVE security report, there were "two groups of eligible voters: (1) American citizens living outside the U.S., and (2) military personnel and their dependents, regardless of whether they reside in the U.S. or overseas."
ThreeBallot is a voting protocol invented by Ron Rivest in 2006. ThreeBallot is an end-to-end (E2E) auditable voting system that can in principle be implemented on paper. The goal in its design was to provide some of the benefits of a cryptographic voting system without using cryptographic keys.
End-to-end auditable or end-to-end voter verifiable (E2E) systems are voting systems with stringent integrity properties and strong tamper resistance. E2E systems often employ cryptographic methods to craft receipts that allow voters to verify that their votes were counted as cast, without revealing which candidates were voted for. As such, these systems are sometimes referred to as receipt-based systems.
Electronic voting by country varies and may include voting machines in polling places, centralized tallying of paper ballots, and internet voting. Many countries use centralized tallying. Some also use electronic voting machines in polling places. Nigeria in 2023 general election used electronic voting machine in pooling stations. Very few use internet voting. Several countries have tried electronic approaches and stopped because of difficulties or concerns about security and reliability.
Scantegrity is a security enhancement for optical scan voting systems, providing such systems with end-to-end (E2E) verifiability of election results. It uses confirmation codes to allow a voter to prove to themselves that their ballot is included unmodified in the final tally. The codes are privacy-preserving and offer no proof of which candidate a voter voted for. Receipts can be safely shown without compromising ballot secrecy.
RIES, for Rijnland Internet Election System, was a project and open source/open patent design and implementation of an Internet election system. RIES was used from 2004 to 2006 for formal elections of the Dutch District Water Boards, and in 2006 to allow expats to vote for the Dutch parliament elections through the Internet. Over 140,000 voters used Ries to cast their vote over the Internet, 19,815 of which were cast in the 2006 parliamentary election.
An election audit is any review conducted after polls close for the purpose of determining whether the votes were counted accurately or whether proper procedures were followed, or both.
The Verified Voting Foundation is a non-governmental, nonpartisan organization founded in 2004 by David L. Dill, a computer scientist from Stanford University, focused on how technology impacts the administration of US elections. The organization's mission is to "strengthen democracy for all voters by promoting the responsible use of technology in elections." Verified Voting works with election officials, elected leaders, and other policymakers who are responsible for managing local and state election systems to mitigate the risks associated with novel voting technologies.
Helios Voting is an open-source, web-based electronic voting system. Users can vote in elections and users can create elections. Anyone can cast a ballot; however, for the final vote to be counted, the voter's identification must be verified. Helios uses homomorphic encryption to ensure ballot secrecy.
Electronic voting in Switzerland started in 2003 in the canton of Geneva, where the residents of Anières cast their vote using the Internet. This was the first trial of e-voting in Switzerland. In the following years, the number of people able to use electronic voting grew as more and more cantons began adopting such a system.
Electronic voting in the United States involves several types of machines: touchscreens for voters to mark choices, scanners to read paper ballots, scanners to verify signatures on envelopes of absentee ballots, and web servers to display tallies to the public. Aside from voting, there are also computer systems to maintain voter registrations and display these electoral rolls to polling place staff.
Direct Recording Electronic with Integrity and Enforced Privacy (DRE-ip) is an End-to-End (E2E) verifiable e-voting system without involving any tallying authorities, proposed by Siamak Shahandashti and Feng Hao in 2016. It improves a previous DRE-i system by using a real-time computation strategy and providing enhanced privacy. A touch-screen based prototype of the system was trialed in the Gateshead Civic Centre polling station on 2 May 2019 during the 2019 United Kingdom local elections with positive voter feedback. A proposal that includes DRE-ip as a solution for large-scale elections was ranked 3rd place in the 2016 Economist Cybersecurity Challenge jointly organized by The Economist and Kaspersky Lab.
↑ Heiberg, Sven; Willemson, Jan (2014). "Verifiable internet voting in Estonia"(PDF). IEEE Conference Publications. 2014 6th International Conference on Electronic Voting: Verifying the Vote (EVOTE): 1–8.
↑ Heiberg, Sven; Parsovs, Arnis; Willemson, Jan (2015). "Log Analysis of Estonian Internet Voting 2013--2015, section 5.24.1". An activist from the Estonian Pirate Party took credit for casting the spoiled ballot [18]. The technique employed involved using a GNU debugger to locate the breakpoint in Linux IVCA where the candidate number is stored and replace it with an invalid candidate number{{cite journal}}: Cite journal requires |journal= (help)
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
