Techtalk - E-government: Voting through your phone — dream or reality?

This article first appeared in Digital Edge, The Edge Malaysia Weekly, on September 13, 2021 - September 19, 2021.
Techtalk - E-government: Voting through your phone — dream or reality?
-A +A

The concept of internet voting, where one can vote remotely via one’s own device, gained relevance after the pandemic halted most activities. For instance, amid the political tussle in Malaysia, many have called for a general election. But there’s a valid concern that political campaigning, coupled with in-person elections, could become a Covid-19 super-spreader event.

In such a situation, would internet voting be a feasible alternative?

Theoretically, internet voting could increase access and boost voter turnout. It could also reduce the cost of running elections since fewer polling stations are needed. However, among the countries that have tested internet voting, the results have been less than stellar.

Trials in Norway were halted over security fears. Internet voting is only available in Ontario, Canada, and some states in the US like West Virginia and Delaware. Currently, only Estonia uses internet voting for national elections.

The main concerns around internet voting include the lack of a paper trail to audit votes, possibility of cyberattacks, identity verification issues and difficulty for third parties to observe the election. Any perception of fraud can result in public distrust of the election results.

But given the advancement of technology, could internet voting become more commonplace in the near future? Digital Edge speaks to experts to find out what it will take.

 

 1  Estonia case study

Estonia is a northern European country with a population of around 1.3 million. While it may not be as popular as its neighbours Finland and Sweden, Estonia is known for being one of the most advanced digital societies in the world, with 99% of its government services available online, according to its official website e-Estonia. Interestingly, the only governmental services not available online currently are marriages and divorces.

The country first began offering internet voting in 2005 for its nationwide elections. Citizens can still opt to vote in person, as internet voting or i-voting is merely offered as an alternative. The latest data shows that 44% of voters used i-voting in the last election.

To use i-voting, the voter logs onto the system using his or her digital ID on a computer and casts his or her vote. The voter’s identity is removed from the ballot before it is counted. The ballot is also encrypted on the computer and decrypted by the election commission after it is anonymised. After casting the ballot, the voter receives a QR code that is valid for 30 minutes. The voter can scan the QR code with another device to verify their vote.

During a designated pre-voting period, voters can cast as many ballots as they want through i-voting. The latest vote is the one that counts. The voter can also cast a ballot in person, and this replaces previous ballots cast via i-voting.

This process is meant to ensure the secrecy of the vote. The minimum voting age in Estonia is 16. Since most teenagers stay with their family, they might face pressure to vote in a certain way. Allowing them to cast votes multiple times and to override internet votes with an in-person vote could circumvent that.

The tallying process mimics the double envelope scheme. The digital outer envelope is digitally signed with the secure e-ID card. Before the vote is counted, the ballot is anonymised by removing this digital outer envelope.

The votes are counted by a computer with the bare minimum capability to prevent any interference from the machine itself. It is also not connected to the internet and the information is read and stored in a DVD drive and smart card reader. Election observers can cryptographically prove that no votes were removed or modified from the electronic ballot box.

The cumulative time saved in the last Estonian elections was 11,000 working days by using internet voting, according to e-Estonia. It did not, however, state whether using such a method reduced the cost of running an election or increased voter turnout.

How could Estonia do it?

In Estonia, accessibility to the internet and devices is high and the digital ID is mandatory. These are often-cited reasons as to why the country has been able to run internet voting successfully. 

In fact, the introduction of internet voting was actually to increase the capabilities of the digital ID, says Dr Robert Krimmer, professor of e-governance at Tallinn University of Technology in Estonia. “Estonia was on the lookout for another application for the ID card. Internet voting fitted the narrative,” he says.

This was also after the debacle of the 2000 elections in the US, where the use of electronic voting machines in Florida resulted in confusion over whether Al Gore or George W Bush won the presidential vote in the state. “Estonia saw that and wanted to show that it could do internet voting better,” says Krimmer.

Of course, this should not be a reason for other countries to adopt internet voting. A country should consider internet voting by first identifying a problem that it wants to solve, Krimmer observes. For instance, countries that have a large diaspora of citizens living abroad or rural populations with difficulty accessing polling stations might benefit from using this method.

But the context must be right. Obviously, the population must have access to the internet and devices. The country must also have a competent and trusted election authority because internet voting requires complex processes. Transparency is of utmost importance, including in terms of how the government chooses the service providers for internet voting.

“Estonia does fairly well in the Transparency International’s Corruption Perceptions Index. You need to have competent authorities who are trustworthy to run an internet voting system,” he says. As part of the Organization for Security and Co-operation in Europe, international observers regularly provide feedback to Estonia’s electoral process.

“There is a continuous improvement process, and that’s really important. Estonia also has domestic observation, where all political parties can observe the setting up of internet voting and the counting process,” he adds.

Estonia is a fairly small country, Krimmer says, so the society is rather tight knit. The country achieved independence relatively recently in 1991, which he says contributes to a sense of unity and pride among Estonians to defend their country.

This was evident in 2014, when a group of international researchers criticised the security of the Estonia internet voting system. Krimmer says the country banded together and focused on improving its systems. Interestingly, e-Estonia publishes the lessons it has learnt from cyberattacks and outlines how the government will respond on its website.

Meanwhile, given the complexity of internet voting, the country must have enough experts to run the system. Krimmer says Estonians are generally IT savvy. There is also a lot of collaboration between network administrators and experts.

“The Estonian Defence League’s cyber unit is a loose [and voluntary] organisation of computer administrators who collaborate to defend the internet in the country. They run simulations before elections as well,” says Krimmer.

Last but not least, there must be strong political will for internet voting to take place. The majority of political parties must be in favour of this system, especially if an electoral law reform is required to introduce internet voting.

It is important to note that internet voting is not always cheaper. When Estonia first started internet voting, it was more expensive than paper voting, he adds. “But now, with almost every second vote cast electronically, internet voting is half as expensive as paper-based voting methods and certainly cheaper than other means like home voting or voting in supermarkets.”

For countries that want to consider internet voting, Krimmer suggests that they take it step by step, engage in public discussion, and identify the exact problems technology can solve. “It’s not an easy process. There have been more failures than successful applications of internet voting in the world,” he says.

 

 2  A risky endeavour but potentially useful

One should not introduce internet voting at a whim. It will require time to pilot the solution, build public trust, engage in extensive consultations with stakeholders and ensure there is transparency in every step, says Dr Staffan Darnolf, senior global adviser at the International Foundation for Electoral Systems (IFES).

Internet voting is probably the most challenging and risky option available. Obviously, there must be trust in the election authorities for this to happen, he adds.

Some countries may be at higher risk from cyberattacks and have lower risk tolerance. On the other hand, the initial investment of setting up the system could be too high for some. It is important for the country to identify the exact problem it wants to solve with internet voting, and then consider if the investment into the system is worth it.

“An argument for internet voting is that it can increase voter turnout. But from what we’ve seen, it’s not automatic. There has been no spike in votes even among the younger voters. You still need to convince them to take part in elections,” says Darnolf.

There are advantages to internet voting, of course. It could be used for countries that have a large diaspora of citizens who previously could vote only by visiting the embassy. A country could start internet voting by testing it on these populations, he says.

“You need to see whether, if you spend the same amount of money on traditional voting methods, you will achieve the same objective,” he explains. In some cases, postal votes might be a cheaper and more effective option.

Regardless, Darnolf believes that internet voting has the potential to be used for a subset of electorates in countries but not for nationwide elections. That is because cyberattacks are widespread currently, and the criminals are indiscriminate in choosing their targets.

“It is also difficult for election authorities to defend themselves against the massive onslaught of misinformation and disinformation. Being transparent, inclusive and having a well-defined communication plan can help counter some of it, but not all,” he says.

“There are so many layers when it comes to trust, confidence and risk when you think about internet voting. Supply chain risk is also a concern, especially when you seek vendors from the international market.”

 

Service providers

• Cybernetica — An Estonian company that provides i-voting services to the country. It formed a joint venture with Smartmatic to develop internet voting on a global scale.

• Microsoft ElectionGuard — An open-source software that provides end-to-end verifiability of election results and has been piloted in some US elections.