Why hasn't Estonia discontinued e-voting?

Question

According to EstoniaVoting:

Estonia is the only country in the world that relies on Internet voting in a significant way for legally-binding national elections — up to 25% of voters cast their ballots online. This makes the security of Estonia’s system of interest to technologists and voters the world over. As international experts on e-voting security, we decided to perform an independent evaluation of the system, based on election observation, code review, and laboratory testing

[ ... ]

What we found alarmed us. There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers, such as Russia. These attacks could alter votes or leave election outcomes in dispute. We have confirmed these attacks in our lab — they are real threats. We urgently recommend that Estonia discontinue use of the system.

(emphasis mine)

as of yet, Estonia have used the e-voting system eight times with binding results.

In 2012 a separate Electronic Voting Committee was established who is now responsible for conducting Internet voting while the National Electoral Committee retains a supervisory role. Internet voting was first introduced in the local elections of 2005, when more than 9 thousand voters cast their ballot via the Internet (this corresponded to about 2 per cent of all participating voters). Today, I-voting with binding results has been carried out eight times in Estonia

With also valid skepticism from individuals within their own government dating back before the release in 2005 on both technical and political issues (Journal of Humanities and Social Sciences)

Still, While Estonia could have easily been the world leader in e-voting by introducing this as a regular feature already for the location elections of 2002, probably genuine worries that technical problems would not be solved by the Fall of that year, as well as the skepticism of individual members of parties generally in favour of e-voting, all of them reasonable and appropriate, were among the reasons that prevented such an outcome. But in the end, it was mainly the resistance of the rural opposition party, which – likewise reasonably and appropriately – feared that such a feature would increase the vote of its competitor parties, and which there would have very rightly and properly fought against it in Parliament, that led to the postponement of actual e-voting in Estonia until 2005.

(emphasis mine)

---

Is there any public research/statements from the Estonian government (or funded by the Estonian government) to support why they still use e-voting?

Answer 1

E-Estonia

Estonia has invested heavily in internet infrastructure in a set of policies called E-Estonia. As part of this, Estonia has declared internet access a human right and strongly emphasizes streamlining conventional governmental processes through information technology.

Additionally, each Estonian has an electronic national ID card which is used to sign official documents online, as well as vote, authorize bank transactions, and may other uses.

So Estonia is pretty committed to this "digital" thing.

Existing Security

According to an article in The Guardian, Estonian officials responded to the security findings by claiming that the attacks described by the security researchers had already been anticipated:

"The researchers have not discovered any new attack vectors that had not already been accounted for in the design of our system as a whole.

"It is not feasible to effectively conduct the described attacks to alter the results of the voting.

"The electoral committee has numerous safeguards and failsafe mechanisms to detect attacks against the elections or manipulated results."

The security researchers seem to agree that some of the security practices in place are strong points in favor of the system. It their article (published in the Proceedings of the Conference of Computer and Communication Security). They mention these strong points:

• The national ID card and its cryptography make many kinds of attacks significantly more difficult.
• The government has released some of the source code of the system, which allows security researchers to recommend fixes to problems before attacks exploit them.
• The Estonian government is actively improving the e-voting system and resolving security concerns.

So the Estonian government doesn't think that the security researchers told them anything they didn't already know. They believe that their existing security should be able to handle the attacks the researchers mentioned.