What challenges remain for online voting?

Question

In 2011, nearly a quarter (24.3%) of participating voters in Estonia cast their ballot by remote electronic voting (that is, on their computer/phone/tablet via the Internet). Several larger countries, including the United Kingdom (63M), France (65M), and the United States (312M) have experimented with the idea of Internet voting, but most applications are experimental or limited in scope.

According to the Caltech/MIT voting technology project, Estonia’s success is in part due to:

• Widespread Internet penetration
• A legal structure that addresses Internet voting issues
• An identification system that allows for digital authentication of the voter
• A political culture supportive of Internet voting

Detractors of Internet voting often highlight security flaws, though integrity of the secret ballot aside, it seems that we have (banking and medicine) systems that can handle information with sufficient security.

Beyond this, what other categories of challenges prevent the widespread adoption of electronic voting?

What challenges remain for online voting? Are they primarily technological or cultural?

Answer 1

There are two challenges to online voting which can be seen as well technological as cultural.

Challenge 1: You cannot at the same time have verifiability of an election and anonymous voting.

This implies that you have to make a tradeoff between an anonymous election (as it is the case with paper ballots) and verifiability. If you want to be sure that each and every vote is counted, you have to identify every voter and provide him with a method to verify that his vote has been counted correctly. In order to do that you need to link voter to vote which would make an anonymous vote impossible.

There are cultures (in working democracies) where public voting is common, so this is mostly a cultural question on how you see voting in those cultures. Nonetheless is there a risk, if a non-functioning democracy would implement a identity-linked voting system, that the regime could after the election prosecute the defectors.

Challenge 2 Accessibility has to be always guaranteed

While the penetration of modern technology has advanced, the knowledge on how to use it has not advanced at the same pace. In order for e-Voting to work (given Challenge 1 resolved) you would need to have people IT-literate enough to use a government-issued certificate to authenticate themselves and be able in general to use computers.

This challenge will automatically be resolved over time, but at the moment, especially in ageing societies of the western hemisphere this is not a given fact.

Answer 2

The largest barrier to online voting is ensuring that fraud does not occur. Somehow you have to have a method to verify that a user has voted, and identifying that user, while not allowing other users to identify who you have voted for. Also, the method of counting the votes has to be similarly protected. Let me divide this into two portions.

Verifiability of the voter:

This is quite a tricky thing, but there is an analog to it already in place in mail ballots. Most mail ballots have two envelopes which contains the ballot. The outer envelope contains enough information to identify the voter. A ballot worker will take this information, verify the ballot, and then place the inner envelope into the ballot pool. So long as this is managed correctly, it would work.

The analog to this in the digital world would be to encrypt your data first with a public key that only the election office can decrypt (Along with a salt to ensure your data can't be guessed via a collision), and secondly with a signature that you have voted, something that presumably would be mailed to you. Your vote is passed to a computer server, which verifies you are eligible, and haven't voted, which then passes the still encrypted vote portion on to a second system, which records your votes. Still, there is some inherit danger in somehow frauding this system.

There are some systems which allow for calculations on encrypted data, but for the most part, these are not yet ready for prime time. Still, these would allow for an even more secure system, one in which all votes could be public, but no one would know who voted for who.

Counting the votes.

After you have voted, your vote must be counted. But how can you actually verify that the vote was accurately recorded? Paper ballots give real tangible proof that there is something, and are rather hard to discard. Also, the polling places must keep track of the number of ballots used, and return even blank and spoiled ballots. Digitally, it would be quite easy to miss some of these votes, and not count them. Of course, the counting time is quite quick. One could imagine a system of verification by randomizing a large number of votes that were known to go a particular way, and auditing the system, perhaps even on election day, to ensure the system counted correctly.

Conclusions

While internet voting would be a fantastic thing, and the technology is starting to come to fruition, it could be abused, and has thus been taking a slow route. I could have mentioned other topics as well, like fraudulent voting sites, etc, but sufficeth to say there are a lot of complexities, and people who would exploit them. Someday we will get there, but the technology just isn't ready yet.

Answer 3

What challenges remain for online voting?

One very important challenge that has not been mentioned so far is simplicity. For democracy, participation is important. And people only participate if they think it is fair. If people don't understand a system, they might tend to think that somebody is cheating in a complicated way.

In Germany, we have some principles for democratic voting:

• universal (German: allgemein): Every citizen who is at least 18 years old has the right to vote. This means especially no discrimination of sex, age, race or religion.
• direct (German: unmittelbar): All candidates get elected directly without an electoral delegate.
• free (German: frei): Every voter may vote for everything that is there to vote.
• equal (German: gleich): No vote is more important than any other vote
• secret (German: geheim): Nobody may know the votes of anybody else.

When you think about the 'universal' principle, it might be a problem for old people (have you ever seen old people trying to dial a number with a smartphone? Have you seen old people trying to use a mouse the first time? Have you seen old people trying to use a touchscreen to buy train tickets? They have problems with that.)

The secret part might also be a problem. It is MUCH easier to put security holes into complex systems than into simple systems. Paper is simple. Machines that need strong cryptography are not.

Another challenge for online voting is paper. The online voting system does not only have to fit some minimum standards but it also has to be better than all other alternatives. And paper is a pretty strong alternative:

• Paper is easy to use (no problem for old people)
• Paper is cheap.
• Paper is simple (easy to understand).
• Paper is hard to manipulate (assuming you have some observers from different parties - if that's not the case, it's quite possible that it doesn't matter anyway because either people are only interested in one party or the election isn't free in the first place)
• Paper is secret: It's very hard to know who made which cross if you have a lot of votes that only have crosses made with the same pen.
• Paper is robust: Have you ever seen a paper "not working"? I didn't. But I have seen a lot of computer systems fail.
• Paper is reliable: Votes made on paper do not change. You can count them. This way, you can easily verify that all votes were counted. If the votes get put into a box that only gets opened when the votes are counted and the votes only get counted in a (possibly locked) room, you do not lose votes. Whereas computer systems fail. The software might have errors or even the hardware. Hardware errors might cause bit-flips sometimes. Such a bit-flip can make one vote not countable / verifiable.
• Paper voting processes are first-hand checkable: If I like, I can just go and observe the election in any electoral district, including the counting of the votes. With an election on paper, I have direct firsthand knowledge of how many votes for whom we had - and I can compare that to the reported official numbers in the newspaper. With a computerized election, I can know firsthand that the prescribed procedures were properly followed, but I can only know what counts the computer printed out, which might have been manipulated by software I can not check. (Thank you cbeleites)

See also

• 90 voting machines not working in Michigan during US presidential elections (source)

Answer 4

Another challenge that hasn't been identified so far is that the system must not make it trivial to sell your vote to a candidate or their supporters directly.

Take for instance internet voting, if you were authenticated only with a login and password and didn't have to prove your identity with more reliable means, what is to stop a party or candidate from going into poor neighborhoods and offering to buy login credentials for $10/pop. Given what national campaigns spend, it would be a much more reliable way to sway a close election (albeit risky).

Answer 5

There's no practical way to solve the problem of client security

The root problem for electronic voting is accuracy. To borrow a design law of online gaming clients by Raph Koster

Never put anything on the client. The client is in the hands of the enemy. Never ever ever forget this.

By "client", Koster means the software running on the end-user's computer. Most people living in democracies have smartphones which can run apps that, at their root, do everything necessary to perform electronic voting (with or without blockchains). The problem is there's no way to ensure the way you voted was sent accurately in the first place

Voatz offers what seems like a simplified voting solution. Registered voters start with a smartphone app available for both iOS and Android. Votes are transmitted to servers hosted on Amazon Web Services, and a copy is stored to a blockchain. The blockchain supposedly offers extra security by making it harder to tamper with votes later.

They forgot the client is in the hands of the enemy

One of [MIT researchers'] big findings was that Voatz's protections against on-device malware were ineffective. The Voatz app comes with software called Zimperium that scans a smartphone for known malware and prevents the app from running if it is detected. But the MIT researchers demonstrated that it was possible to modify the Voatz app to prevent Zimperium from running in the first place.

Once these security checks are disabled, the Voatz app can be modified to undetectably change voters' choices. "It is straightforward to modify the app so that it submits any attacker-desired vote, yet presents the same UI as if the app recorded the user’s submitted vote," the researchers wrote.

We visit my in-laws somewhat infrequently and inevitably I get asked to look at computers. Somehow, they manage to install all sorts of malware crap extensions into their browsers. Cell phone apps could also modify how voting apps work, and transmit votes the user did not intend.

Answer 6

There is also another important problem which I think it has not been addressed: you can not guarantee the freedom of choice of your vote. If the vote of a person is made from his/her home, then it is susceptible of being hijacked by a third person or organization. Imagine an organized group that go house by house to ensure what people are voting, so you can only vote if someone is controlling you, or otherwise you will not have their favor.

This was one of the reasons for what cell phones (and any other device that could take a picture) were forbidden in the Italian voting booths (see Reuters and BBC), since local mafia bosses aimed to control the vote of citizens by coercing them to take a picture of their vote for showing later.

In my opinion this is one of the biggest problems related with real online voting. Of course the solution will be to provide voting centers, but this will be too similar to the traditional system and hence not a real improvement for the voter's comfort.

Answer 7

There is a bunch of requirements for proper voting most countries try to adhere to:

1. Anonymity - no one can find out for whom someone else voted
2. Accountability - you can be sure that your vote is counted for the one you want it to count for
3. Equality - every vote counts equally, everyone has the same amount of votes
4. Understandability/Trust - you understand how the voting works, you could verify each step and therefore then trust that it works, assuming you'd check every part of it

Now many answers address the first three issues. Those already pose a challenge as it is hard to make something anonymous and still give you the chance to verify your vote has been counted correctly. There are however technical solutions to that - to a certain degree. There will always be at least practical flaws (if the process is safe, just hack the private machines of voters and control them when they vote, or vote in the last second for those who didn't choose to etc.). And the general concern is that the benefit of electronic voting - to be able to do shit faster, more generalized and connected - is also a benefit for everyone wanting to manipulate the vote, as they don't need a broad support network to manipulate votes in many places, the software can do that nice and comfortably.

But even if we'd come up with the perfect system and all the experts would be convinced that it's safe, we couldn't achieve the fourth point. To be secure it needs to be quite technically complex - definitely more than most people with an average school degree can claim to fully comprehend and be sure it works. We'd have to rely on trusting the "experts". Which translates to "the authorities" or "them smartasses up there", so it's not a good trust foundation. Well, you might have people just use it and trust it as they do with Facebook, but hopefully more people would question such an essential system.

At least in a crisis where there is already distrust towards the government it makes it much harder to point to election results as what gives the government their power.

Even if code is open source etc. you'd need to unscrew every machine and make sure that it runs the software that you've seen on GitHub or where-ever and most people wouldn't even understand the software or be able to tell a secure way of getting that software on the machine from an insecure way. Many wouldn't even know any way to get it onto the machine...^^

So the fundamental problem is not even that it can be more easily misused in a systematic undetectable widespread way, but that the general populous never should fully trust it as it cannot step by step control individual steps without an additional paper trail at each step. And if we need the paper trail, we need to look at it - and if we need to look at it, we basically loose the benefits of the online voting.

What can be done is using assistance software, but only if you keep the paper trail, so you can check each step separately.

As for the difference to banking systems - you automatically notice if the result of your actions isn't what you wanted, i.e. money missing or going to the wrong person, because you have all the decision power, there is no distributed decision involved here.

Answer 8

For me the most worrisome issue of online voting is the danger of systematic voting manipulations. After all, guaranteeing that the voting result is as unaltered as possible is of utmost importance in any democracy.

With manual (human) counting and reporting and recounting and re-reporting via different pathways there is a system in-place that is extremely secure in this regard. If some people want to manipulate such an election, the impact can effectively be kept local and small.

In contrast however with any kind of online vote... forget it! No guarantee whatsoever! Any hacker could potentially influence the whole voting result at once. This results in a very high risk of manipulations.

Example:

Jérôme Kerviel manipulated the computer system of Société Générale in 2008 and caused a loss of about 5 billion Euro all by himself. Banking computer system are said to be very well scrutinized but for those who know what they are doing, it obviously is not an unbreakable barrier.

In the end, my money is less important to me than my vote. So my vote must be guarded even better and the best guard is counting votes manually.

(As a side note: I don't see any significant advantage of online voting either.)

Answer 9

1. There is a lot of money to be made by selling both the Hardware and Software to run elections. A simple, easily verifiable solution is not one that benefits the dominant parties since they spend a good deal of time after the election challenging results. There is quite a bit of money tied up in the process that allows for the manipulation of the system in close races. There are lobbyists that are fighting for more complex and flawed solutions that would through tons of money at donor companies to pretend to provide a solution knowing it will not solve the problems that they do not actually want to solve.

2. The internet is not secure. The nature of the internet means that it is basically impossible to hide the servers that are running the election. having ~20 million people attempting to vote over less than 24 hours means that it will require many servers and if even one gets compromised the entire election results could be spoiled. Super high security targets like these would have to be are targets of hackers because of the difficulty. This would be their Mount Everest. And they could do it from someplace that was safe from US law enforcement.

3. There is a barrier to the population to convince them that it is safe and secure to vote online anonymously. The nature of the technology required would make it trivially possible to link the votes to the voter if they have access to the servers running the internet. Our government officials have shown nothing more clearly than they can not be trusted with the election. Even if it wasn't the actual candidates then there is still the giant group of people who work on the campaign. Any of these that might gain access to the election systems creates a risk of failure. In a super centralized election process like this would be a failure that invalidates one vote calls the entire process into question.

Answer 10

For another practical example of the challanges, SlashDot recently ran a story on Paris primary where electronic voting was easily subverted:

http://politics.slashdot.org/story/13/06/02/2112248/in-france-a-showcase-of-what-can-go-wrong-with-online-voting

"Fake votes mar France’s first electronic election (from Independent)"

Journalists from the news site Metronews proved that it was easy to breach the allegedly strict security of the election and vote several times using different names.

To register their vote on-line, Parisians were supposed to make a credit-card payment of €3 and give the name and address of someone on the city’s electoral roll. Metronews said that one of its journalists had managed to vote five times, paying with the same credit card, using names, including that of Nicolas Sarkozy.

Answer 11

Assuming "Democracy" means "Direct democracy", ie "by the people". The main issues are both "cultural" and "technological".

Weak democracies

The main challenge for online voting is the fears about non secret votes. Drop privacy: online voting becomes easy and fraud immune.

But people tend to believe that secret voting is a "requirement" for Democracy (to avoid pressure). Yet the same people would often agree than in a strong healthy democracy, nobody should be afraid to express opinions publicly. In a strong healthy democracy, people would organise forces to protect people against abusive pressure.

If our democracies were strong and healthy enough, nobody would require vote privacy ; on the contrary people would want to make their opinion public, to propagate the ideas they believe in.

Technological evolution

With online voting, more "direct" democracy becomes possible. "Direct democracy" is not something that "representatives" likes. As a result they distill fear to keep the status quo, avoid online voting and remove the power from the hands of the people.

There exists tons of online votes today. In this very site for example. Or with "likes" on Facebook. The Pirate Party uses "Liquid Democracy".

Young people are used to that. They will want the same for increasingly serious matters. It is a question of time.

Answer 12

The digital divide is another factor here - not everyone has access to a computer.

For some, it would be considered an issue of fairness if the "rich" could vote from their houses, but the "poor" without access to a device, would need to take time off of work and pay transportation costs to a polling place (which would most likely be further away), in order to vote.

These problems are not insurmountable, but they would need to be addressed in localities that are much larger than the tiny country of Estonia.