11

According to EstoniaVoting:

Estonia is the only country in the world that relies on Internet voting in a significant way for legally-binding national elections — up to 25% of voters cast their ballots online. This makes the security of Estonia’s system of interest to technologists and voters the world over. As international experts on e-voting security, we decided to perform an independent evaluation of the system, based on election observation, code review, and laboratory testing

[ ... ]

What we found alarmed us. There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers, such as Russia. These attacks could alter votes or leave election outcomes in dispute. We have confirmed these attacks in our lab — they are real threats. We urgently recommend that Estonia discontinue use of the system.

(emphasis mine)

as of yet, Estonia have used the e-voting system eight times with binding results.

In 2012 a separate Electronic Voting Committee was established who is now responsible for conducting Internet voting while the National Electoral Committee retains a supervisory role. Internet voting was first introduced in the local elections of 2005, when more than 9 thousand voters cast their ballot via the Internet (this corresponded to about 2 per cent of all participating voters). Today, I-voting with binding results has been carried out eight times in Estonia

With also valid skepticism from individuals within their own government dating back before the release in 2005 on both technical and political issues (Journal of Humanities and Social Sciences)

Still, While Estonia could have easily been the world leader in e-voting by introducing this as a regular feature already for the location elections of 2002, probably genuine worries that technical problems would not be solved by the Fall of that year, as well as the skepticism of individual members of parties generally in favour of e-voting, all of them reasonable and appropriate, were among the reasons that prevented such an outcome. But in the end, it was mainly the resistance of the rural opposition party, which – likewise reasonably and appropriately – feared that such a feature would increase the vote of its competitor parties, and which there would have very rightly and properly fought against it in Parliament, that led to the postponement of actual e-voting in Estonia until 2005.

(emphasis mine)


Is there any public research/statements from the Estonian government (or funded by the Estonian government) to support why they still use e-voting?

7
  • The report you cite is dated May 2014. Out of the eight elections listed in your other link, all but one (March 2015) were prior to that. So even if that report was enough to convince them to change the system (and I have no idea if that is the case), it may have taken longer than ten months to do so.
    – Geobits
    Apr 27, 2017 at 11:47
  • That's a very valid point, but I was only merely pointing out about the report for some context as to why I'm asking. I can only assume since it began there would have been skepticism about it (internationally) from the get go (or close to it). I'll try and cite something a little earlier. Apr 27, 2017 at 11:54
  • @BradleyWilson even Brazil kept its electronic voting system a black box for several years (they now allow independent evaluations), despite the criticism of security experts. Probably Estonia is not interested in discontinuing the use of the e-voting because they can defraud the elections as well as a foreign attacker. Apr 27, 2017 at 16:40
  • @Mindwin, very interesting. I'll have a read up on the brazil situation now. I am specifically asking whether the Estonian goverment (or government funded facility) has done any research in support of the idea. If that backs up your assumption, that would be a great answer. Apr 27, 2017 at 16:44
  • Proving something does not exist is not trivial, but I doubt they would fund such studies. Politicians like people to believe their propaganda, and nothing more. Apr 27, 2017 at 18:16

1 Answer 1

11

E-Estonia

Estonia has invested heavily in internet infrastructure in a set of policies called E-Estonia. As part of this, Estonia has declared internet access a human right and strongly emphasizes streamlining conventional governmental processes through information technology.

Additionally, each Estonian has an electronic national ID card which is used to sign official documents online, as well as vote, authorize bank transactions, and may other uses.

So Estonia is pretty committed to this "digital" thing.

Existing Security

According to an article in The Guardian, Estonian officials responded to the security findings by claiming that the attacks described by the security researchers had already been anticipated:

"The researchers have not discovered any new attack vectors that had not already been accounted for in the design of our system as a whole.

"It is not feasible to effectively conduct the described attacks to alter the results of the voting.

"The electoral committee has numerous safeguards and failsafe mechanisms to detect attacks against the elections or manipulated results."

The security researchers seem to agree that some of the security practices in place are strong points in favor of the system. It their article (published in the Proceedings of the Conference of Computer and Communication Security). They mention these strong points:

  • The national ID card and its cryptography make many kinds of attacks significantly more difficult.
  • The government has released some of the source code of the system, which allows security researchers to recommend fixes to problems before attacks exploit them.
  • The Estonian government is actively improving the e-voting system and resolving security concerns.

So the Estonian government doesn't think that the security researchers told them anything they didn't already know. They believe that their existing security should be able to handle the attacks the researchers mentioned.

1
  • 1
    A great reminder: just because a "security researcher" says your system is broken doesn't mean it's actually broken. See Telegram for another good example of futile accusations. Apr 28, 2017 at 8:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .