Podcast 🎧 and blog: Risks and opportunities in voting on the internet

When it comes to political participation, elections represent something that most countries have in common, but that differentiates them between each other at the same time. All democratic nations set rounds of voting to renew people’s representatives in national assemblies; however, almost all nations vary in the ways elections are carried out.

From registration to counting and publishing of the results, there are many opportunities to implement electronic means to facilitate and streamline the process of voting. But moving parts of this process to the cyberworld, of course, carries related risks.

Two experts in cyber security and electronic voting, Liisa Past and Epp Maaten, delve deep into the challenges and breakthroughs of making digital solutions common practice in elections.

Why use digital solutions in elections too?

The speakers of today’s issue of the Digital Government podcast have a far-reaching background in electronic voting and the risks connected to it.

Liisa Past, outgoing Chief Cyber Risk Officer for the Government of Estonia, was also one of the driving forces behind the Estonian Comprehensive Risk Assessment of Elections, as well as the Compendium on Cyber Security of Election Technology. Epp Maaten instead, currently Programme Director of Cyber Security at eGA, has served in the Estonian National Electoral Committee and as Deputy Head of the Electronic Voting Committee.

Within the context of the global COVID-19 pandemic, carrying out elections by means of digital solutions can also help curb the spread of the virus – less contact between people, less paper used. “Voting is one of those interactive real-life experiences at the heart of democracy, representing also one of its rituals, we may say. But how to balance participation and public health? ” Liisa Past begins with.

The question is timely and relevant. Just to give an example of the upcoming rounds of voting around the world, just next month people in the United States will vote in the presidential elections.

Internet voting is often indicated as the obvious, go-to solution. “But I would pull the breaks on it, because internet voting must fit into a lively ecosystem of digital services,” Past warns. “Governments can introduce electronic solutions also at different steps of the electoral process, such as when it comes to the registration of voters and candidates, or publishing the results. However, we must keep in mind that elections can’t be more digital than the government they support,” she says.

Not all technology is the same – electronic and internet voting

As emerged, a fundamental distinction has already been introduced here. “Although internet voting might be also called ‘electronic’ in some countries, the two things are not the same,” Epp Maaten points out. For a brief definition:

• Electronic voting – the deployment of any kind of electronic technology for the casting of ballots, such as in the US example with their ballot machines;
• Internet voting – a particular way of remote voting that involves casting ballots through the internet.

Both represent alternatives to the traditional ballot paper, still without excluding or precluding its use. “Running elections varies greatly across countries, but almost everyone uses digital means – except for the Netherlands, a notable example – at some stage of the electoral process,” Liisa Past says.

Risk assessments must be comprehensive and multi-disciplinary

But as for all ventures involving the use of technology to some extent, new threats may come to the surface. This becomes even more relevant in the case of elections, where at stake is the organization and configuration of power relations in democratic institutions.

Inherently, “a risk is the likelihood or probability that vulnerabilities in the system will be exploited for malicious purposes. As a consequence, we need to consider what are the assets at stake that we need to protect,” Maaten says.

This pertains to information systems, as well as to broader, more political and sociological issues – trust in democratic institutions, legitimacy of the process. Evidence shows that the risks connected to voting by means of digital solutions might go beyond mere technical points.

“Sometimes the aim is not even to change the outcome of the vote, or to attack an information system, but to create confusion around elections as such. In short, to undermine democratic governance. For this reason, when it comes to risk mapping and management, we must look at all these instances in a comprehensive way. This is something that election managers are ill-positioned to do alone, making the case for involving other specialists as well, to jump in and help,” Past highlights.

Lessons learned and transparency as a key precondition

However, unlike with other e-services, it seems more complicated to generate trust in the technological process supporting electronic and internet voting. Elections are about the participation of the many – and, of course, no one can reasonably expect everyone to be so versed in cryptography to consciously understand it.

As often, the solution lies in transparency. “Whatever you do, on par with bringing in digital solutions, must be done as openly as possible. And if necessary, involve also the critical voices within the debate, such as technicians with doubts on the effectiveness or security of the process, to discuss and reach together an understanding of how the system could work better,” Maaten points out.

This “aggressive openness and transparency”, as defined by Liisa Past, has been fundamental in making internet voting one of Estonia’s success stories. First adopted in 2005, it slowly peaked up to reach outstanding numbers election after election. In 2019, when citizens were called to vote for the renewal of members of the Estonian and European assemblies, 43.8% and 46.7% of all ballots were cast online, respectively.

Three are the main lessons learned from the Estonian experience:

• Electronic means do not increase participation as a whole, but offer more options to people. This might be important in particular to specific demographic groups, such as residents in remote places or with limited ability, or even students and workers momentarily abroad while an election takes place;
• Habits matter, as trust in the technology is reinforced by its constant deployment in other areas of government and service provision;
• Risk mapping and management is crucial because, by means of electronic or internet voting, people delegate trust into complex math. Such trust must be cherished and protected carefully, to ensure the legitimacy of democratic practices and institutions.