A Comparative Assessment of Electronic Voting
Part IV: European Trials
The country of Estonia is a significant case with regard to Internet voting for several reasons. First, Estonia is the only country worldwide to have introduced remote Internet voting on a national scale. Second, its model of remote electronic voting incorporates plans to expand and incorporate other remote electronic voting methods, such as SMS text message voting, by 2011. Third, Estonia is the only country in the world to have legislated Internet access as a social right (Trechsel, 2007:9). Estonia is one of the most electronically enabled countries in Europe, rating fourth among the EU-25 in terms of the availability of on-line public services (Estonian National Electoral Committee, 2009). These elements, and the fact that Internet voting in Estonia can be considered an electoral success, make it an important case for examination, particularly to observe features that have supported and allowed for the successful operation of a remote Internet voting system.
Rationale for introducing remote Internet voting and necessary preconditions
The motivation to introduce remote Internet voting in Estonia was primarily to increase the number of voting methods that are available to electors and to make the process simpler and more convenient. One of the objectives of making the voting process more accessible was to increase turnout and dissipate feelings of political alienation, particularly among youth. The Estonian Parliament also felt remote Internet voting allowed for more efficient use of existing technical infrastructure, and that voting on-line remotely should be considered an essential convenience in modern society (Lumi, September 19, 2009; Madise and Martens, 2006). More generally, the Estonian government is focused on developing policies and services that are citizen-centric and highly inclusive (Estonian National Electoral Committee, 2009).
A number of key features were present that made introducing remote Internet voting viable and that have enabled it to work well in Estonia. These include the degree of Internet penetration and electronic readiness among citizens, a supportive political culture, a legal structure that addresses remote Internet voting, a digital identification system, modern infrastructure and government IT programs, as well as a partnership between public and private sectors (Alvarez et al., 2009; Lumi, September 19, 2009). Data from the European Commission reports that Estonia is among the top 12 in the European Union in terms of Internet penetration: 53 percent of all Estonian households own a computer, and 89 percent of these are connected to the Internet (Alvarez et al., 2009; Estonian National Electoral Committee, 2009).
Estonia has also taken great care to develop a legal framework that supports the development and use of remote Internet voting. This began with the passage of the Digital Signature Act in 2002, which allows citizens to use approved digital signatures to confirm their identity in on-line transactions, including government transactions and voting. While the USA has also legislated digital signatures, Estonia is the only country to have simultaneously mandated and introduced an identity card with an embedded digital certificate. The card is the basis for the Estonian remote Internet voting model and allows for remote identification with the use of the signature and a unique personal identification number. The cards can be used at home with the addition of a smart card reader, or at a public access terminal (55 terminals per 100,000 citizens) (Alvarez et al., 2009; Lumi, September 19, 2009; Madise and Martens, 2006).
The second part of the legal framework was the passage of various acts that permitted the use of electronic voting in the different types of Estonian elections and specified their administration. The laws also established related procedural elements such as the period of time wherein on-line ballots could be cast, the process for certifying that on-line ballots could not be cast on election day, the authentication process, and the process for merging and counting all ballots after the election.36 The Estonian system also allows on-line electors to change their electronic ballot any number of times, with only the final ballot counting toward the actual vote (Alvarez et al., 2009; Madise and Martens, 2006).37
Development, technical features and general operation of Estonia's model
Remote Internet voting in Estonia was introduced in the 2005 municipal elections, and then used again in 2007 for national parliamentary elections and in 2009 for European Parliament elections. The Estonian model is based on three principles: (1) the identity card for voter identification, (2) the possibility of re-voting electronically with only the final ballot counting, and (3) the priority of traditional voting (should an elector vote by paper ballot on election day their electronic ballot is deleted). Other basic principles to which the system is required to adhere include a reliable, secure and accountable method of counting, simplicity for electors as well as experts who may audit the system, transparency, and one vote per voter. All ballots must be uniform and secure and all electors must be able to vote (Maaten, 2004).
To use remote on-line voting, electors require a smart card reader and relevant software, an Internet connection and a Windows, MacOS or Linux operating system. The voting process begins by inserting a valid ID card into a computer whereby a list of candidates is displayed based on the elector's personal identification number. The voting system uses a "double envelope scheme", typically used in other countries for postal voting, and was designed to ensure voter privacy and security. Once the voter completes the ballot it is encrypted by the voting application (i.e. the voter seals the ballot in a blank inner envelope). The voter then confirms his or her choice with a digital signature and receives confirmation that the vote has been recorded (i.e. the voter puts the inner envelope into the outer one and writes his or her name and address on it) (Estonian National Electoral Committee, 2009). When the votes are counted, the digital signature (outer envelope) is removed and the anonymous encrypted vote (inner envelope) is placed in the ballot box. Remote Internet voting is only available for a certain period, usually from four to six days prior to advance voting days, and therefore not on election day. Electors are able to change their vote as many times as they like as long as the on-line polls are open and can still vote by paper ballot on election day, although this would disqualify their electronic ballot (Maaten, 2004).
Indicators of success
The Estonian model can be considered a success on a number of levels, particularly with respect to public use and voter turnout. For example, while in the 2005 local elections only 1.9 percent of votes were cast remotely by Internet, in the 2007 parliamentary elections it increased to 5.4 percent, and in the 2009 European Parliament elections to 14.7 percent of votes cast (Estonian National Electoral Committee, 2009).38 Estonian officials now describe remote Internet voting as an accepted and expected feature of the electoral process, and one that is essential in engaging electors. Turnout in parliamentary elections increased from 58.2 in 2003 to 61.9 percent in 2007 and from 26.8 percent (2004) to 43.9 percent (2009) in the European parliament elections, which had record-low turnout levels among some other countries (International IDEA, 2009). Furthermore, recent research confirms that electors have a high degree of trust in remote electronic voting (Alvarez et al., 2009; Lumi, September 19, 2009). Research also shows that the Estonian system is neutral with respect to many socio-economic factors such as income, education, gender and geography. This finding suggests that no undemocratic biases or digital divides (specifically biases that are socio-economic in nature) have developed as a consequence of remote Internet voting with respect to those variables. Research also supports that there is no left/right political bias among remote Internet voters in Estonia (Alvarez et al., 2009:501).
The most prominent concerns surrounding the implementation of remote Internet voting in Estonia were related to potential fraud and privacy. In response, the principle of multiple votes was created, which allows electors to cast an electronic ballot as many times as they like during the on-line voting period. In case an elector is pressured at any point in time to vote a certain way, that individual can go back and change his or her vote from a secure and private place or can vote in person on election day, mitigating vote-buying and ensuring voter secrecy (Madise and Martens, 2006).
There were also concerns regarding the possibility of a digital divide or disparities in Internet access related to generation, gender and socio-economic factors. To mitigate these effects, the state launched an Internet and computer training program for adults in 2001 as well as the Village Project which provided more libraries with computers and Internet access. More recently, they have launched public/private projects, such as "Computer Security 2009" and the state-run Information Society Awareness Program that seek to promote the use of electronic services by targeting security issues and improve the identity card application process (Estonian National Electoral Committee, 2009; Maaten, 2004).
There are also some problems with the system that have not been addressed. Foremost, the electronic voting system is only provided in Estonian (the official language) despite the fact that there is a very large Russian-speaking population in Estonia. This has created a barrier resulting in many Russian speakers not voting on-line (Alvarez et al., 2009).
In terms of accessibility, more than 80 percent of Estonians have identity cards, but this means that for some citizens voting on-line is not an option. Furthermore, even with an identity card citizens must have a smart card reader, which costs about 20 euros (Maaten, 2004). While smart card readers are available at public access points, these are still obstacles to voting that have not been fully resolved.
There are several reasons for examining Geneva's experience with Internet voting. Switzerland was one of the first countries to develop a remote Internet voting application, and because it developed and fully implemented a remote Internet voting program, the Swiss model is much more advanced. Second, the remote Internet voting program in Geneva is the most experienced worldwide, having conducted more elections than any other country or jurisdiction where remote Internet voting is a viable voting option (Alvarez et al., 2009). Third, the Geneva model has followed a tightly controlled development process, which has been cited in large part as contributing to its success (Chevallier et al., 2006). Finally, Geneva has established a permanent legal basis for Internet voting. Since the Genevan model of remote Internet voting is perhaps the most refined in the world, the Internet application it relies on during elections is of importance when developing models elsewhere.
Rationale for introducing remote Internet voting
Geneva decided to pursue remote Internet voting for several reasons; foremost among them was enhancing convenience for electors and increasing turnout. Swiss voter turnout is one of the lowest of established democracies worldwide, averaging about 50 percent (Auer and Trechsel, 2001). Partially this is because of Switzerland's direct democracy system whereby electors are called to the polls an average of 4 to 6 times yearly (Geneva Internet voting system, 2003). Switzerland also had great success with postal voting, suggesting that the introduction of remote Internet voting might yield similar benefits. Familiarity with postal voting also meant that voters were accustomed to voting from home and having several weeks to vote. Other reasons include the large proportion of Swiss citizens who live abroad (580,000 of 7 million) and a norm that Geneva's public service prides itself on its proactive attitude toward technologies (BeVoting, 2007; République et Canton de Genève, 2009; Geneva Internet voting system, 2003). Internet penetration in Switzerland is such that slightly more than half the households have Internet access (55 percent), and survey data showed that two thirds of Internet users wished they could vote on-line.
At the federal level there were several parliamentary motions in 1999 and 2000 "that called the Confederation to do something in the field of" information and communication technologies, although Internet voting was not mentioned specifically, and in 2002 Parliament adopted an article that allowed for Internet voting trials (Chevallier, 2009). At the Geneva level, in 1982 Parliament passed a law on political rights enabling experimentation with voting methods. This provision was used to develop Internet voting until Parliament (June 2008) and the citizens (February 2009) approved a constitutional amendment that permitted Internet voting (Chevallier et al., 2006; Chevallier, 2009). Other factors that supported the success of the Swiss remote Internet voting application include a centralized and computerized voters list, experience with direct democracy and a "soft" approach to voter secrecy (République et Canton de Genève, 2009).39
Development, technical features and general operation of Geneva's model
In 1998, the Swiss Federal Executive first launched its e-government project, which included the possibility for remote Internet voting and other forms of electronic participation. The federal government invited three of the most urbanized cantons (Neuchâtel, Geneva and Zurich) to pilot remote voting methods and agreed to jointly fund the project. In Geneva, beginning in 2001, the system underwent numerous trials, initially restricted to participation in referendums, and later followed by eight official ballots between 2003 and 2005 (Chevallier et al., 2006; Kies and Trechsel, 2001).40 During these trials electors were able to vote by traditional ballot, postal voting or remote Internet voting, although postal voting and remote Internet voting were only available prior to election day. The success of these initial trials prompted the federal government to legalize remote Internet voting throughout the country in 2006 (République et Canton de Genève, 2009).
The remote Internet model used in Geneva is an adaptation of its postal model. All electors are sent a voting card, which can be presented when voting by paper ballot, mailed back with a postal vote or used to obtain codes which permit on-line voting. Each card contains a unique 16-digit number designating the particular election, a 4-digit control key, and a secret 6-digit code that is concealed under a scratch-away opaque layer (Chevallier et al., 2006:439).41 The elector begins by entering the 16-digit code on-line. This code is verified by the server and the 4-digit key is sent back to the user as a self-authentication. The server then constructs the electronic ballot and establishes a protected connection between the elector and the ballot. Once the ballot is completed the choices are presented to the voter for confirmation. Selections are then either confirmed or altered by the elector, who is prompted to provide his or her date of birth, municipality of origin and the 6-digit secret code printed on the voting card. The vote is then authenticated and the voter receives electronic confirmation that a ballot has been cast (Chevallier et al., 2006).
In terms of security Geneva does not use digital signatures or require additional computer hardware like Estonia. The system does however operate similarly with respect to the envelope feature which keeps the ballot and voter's identity separate. Once cast, the ballot is encrypted with alphanumerical characters, which masks its content (the first envelope is sealed). When the voter confirms and attaches his or her identity to the ballot, it is encrypted with another protective layer (second envelope). Once the vote is received, the identity and the ballot (the two envelopes) are kept in different files. Before the ballot box is opened the ballots are shuffled so that they do not correspond with the voter registry. Other security mechanisms include a certified Web site, and a secure channel between the elector's computer and the server facilitating the vote (Chevallier et al., 2006; République et Canton de Genève, 2009).
Indicators of success
Overall the system is considered highly successful, notably because the public is very responsive and actively makes use of remote Internet voting, and because it appears to have a positive effect on voter turnout. For example, public opinion data revealed that electors who chose to vote remotely on-line were likely to continue to do so (90 percent of voters) and that remote Internet voting is used as the primary voting channel for electors under the age of 50 (République et Canton de Genève, 2009).42 Data reveals that there is no digital divide with respect to education or gender, but one is visible in terms of age and Internet competence. Furthermore, although there are no comprehensive figures regarding turnout, 12 to 27 percent of on-line voters previously described themselves as being frequent abstainers, particularly among electors aged 18 to 39 years (République et Canton de Genève, 2009). These statistics suggest that the extension of remote Internet voting has positively impacted turnout and encouraged the participation of younger electors.
System approval can be attributed to three aspects of the development process. First, the project was initiated and sponsored by the highest official of political rights in Geneva, the State Chancellor. The Chancellor delivered regular progress reports to government as well as representatives from all political parties, confirming each step of the way that system developments met the needs and expectations of the parties and the public. Second, system development and implementation took a step by step approach in which trials were gradually expanded along two dimensions: the stakes of the vote and the number of potential voters (Chevallier et al., 2006:439). This process allowed officials to improve the project as it developed and to better manage risk. Finally, the teams assigned to project development were multidisciplinary, including experts from a variety of fields. This combination of knowledge and alternate perspectives helped foster a well-rounded system that was not overly centered on any one aspect of model development, such as security or technical considerations (Chevallier et al., 2006).
Despite its success, Geneva faced some important challenges. Two obstacles in particular are worth noting. In terms of legalities, the right of every Swiss citizen to attend ballot counting at his or her polling station was solved by creating an electoral commission with representatives selected by political parties and appointed by government to oversee the counting of postal ballots. The body controls the ballot box reading and the role of the electoral commission was expanded for the introduction of Internet voting.43 Furthermore, though initially the issue of vote-buying was also a prominent concern, this was mitigated by providing voters with confirmation that their ballot had been cast, but including no details regarding its content.44 There have been no concerns or problems with regard to remote Internet voting that are considered insurmountable in Geneva.
The UK is an important case study because it was one of the first countries to experiment with multiple types of remote Internet voting and because of the sheer number of trials and types of electronic voting methods it has tested. Furthermore, the UK experience is salient because its Electoral Commission decided to end electronic voting trials. While it is useful to examine cases where Internet voting models have been implemented successfully, it is also important to look at the considerations that led another jurisdiction to terminate the project.
Rationale for introducing remote electronic voting and necessary preconditions
The UK chose to pursue an electronic voting model in an effort to modernize the electoral system and generate public confidence in these modifications, attract younger voters and, most importantly, increase electoral participation. Making the process more accessible for electors of all kinds was also an important consideration (Local Government Association, 2002). By introducing remote voting options the government had the option of extending the voting period, further enhancing accessibility for electors.
The government created the Electoral Commission in 2000, a body whose mandate is to organize some elections, carry out research, and seek out reforms that have the potential to positively impact British elections. The Commission was supported by two bodies, the Department of Constitutional Affairs and its Electoral Modernization Unit, which initially pressured the government to investigate establishing new voting opportunities to increase turnout. The UK's Electoral Commission conducted extensive research prior to the inception of the trials, notably a full analysis of all potential options and technologies, a review of experiences in other jurisdictions, legal framework analysis as well as survey research probing the perceptions of different stakeholders and public attitudes and opinions toward electronic voting (this included data regarding reported likelihood of use and public confidence). In terms of public acceptance for example, survey research revealed widespread support for electronic voting. More than half (55 percent) of eligible voters reported that the extension of electronic voting would encourage them to vote in the next election. Among young people (aged 18 to 24 years) this figure rose to 75 percent (The Electoral Commission, 2003).
The development of the UK's legal framework is also particularly interesting because before the trials could proceed an amendment to existing legislation was required whereby the local authority ceded control to the central government and relinquished its autonomy with respect to elections (Liptrott, 2006). The passage of the Representation of the People Act (2002) enabled this and allowed Parliament to develop regulations which permitted the conduct of pilots with alternate voting arrangements (Barry et al., 2002). These prerequisites were considered important steps before proceeding with actual implementation.
Development, technical features and general operations of the UK trials
Aside from the research conducted by the Electoral Commission, the actual model development for each local council began when the Department of Transport, Local Government and Regions (the department responsible for electoral policy) issued a request for proposals from companies to supply electronic voting and electronic vote counting and recording. Upon selecting a list of successful providers, local councils were invited to submit suggestions for pilots that held promise to modernize the electoral process. Those councils whose proposals were selected chose an industry partner from the list of providers and the pilots were developed on an individual basis.
The first electronic voting pilots took place in May 2002.45 Thirty different electoral districts from across the country took part in the trial, sixteen of which piloted electronic methods. The trials were made available to 2.5 million electors and operated with a budget of 4.1 million pounds (Barry et al., 2002). Electronic trials used a variety of technologies and combinations of those technologies in different districts, including touch-screen kiosks (in polls and remote locations), remote Internet voting, telephone, SMS text message voting and electronic counting schemes. While some districts trialled one or two methods, many piloted multiple channels of electronic voting, making two or more methods available (4 in 2002 and 13 in 2003). The multi-channel approach was facilitated by an on-line electoral register that was developed to provide the necessary infrastructure for districts trialing more than two electronic methods (Xenakis and Macintosh, 2004).
In May 2003 the UK Electoral Commission conducted another 59 pilots in local districts, 18 of which trialled various types of electronic voting, at a cost of 18.5 million pounds (Open Rights Group, 2007). Again, the electronic trials offered different electronic services depending on the jurisdiction. The same potential methods that were used in 2002 were again made available, with the addition of digital television voting and smart card technology (Xenakis and Macintosh, 2004). In most instances different combinations of multi-channel voting were offered. For example, the council of Ipswich made remote Internet, telephone and SMS text messaging ballot options available, whereas Shrewsbury and Atcham offered remote Internet, telephone, digital television and all-postal voting as well as electronic counting. Sheffield, by comparison, used remote Internet voting, telephone, public kiosks and mobile phone text messaging as alternative voting channels. All-postal ballots were offered in over half of the municipalities and electronic counting was implemented in many areas, as were extended voting hours (Norris, 2005). Overall, the 2002 and 2003 pilots consisted of 14 trials of remote Internet voting, 12 trials of telephone voting, 8 trials of electronic voting at polling stations, 4 trials of SMS text message voting, 3 trials of touch-screen kiosks, and 1 digital television trial reaching approximately 6.4 million electors (BeVoting, 2007; Liptrott, 2006).
It is difficult to offer a summary account of the specific procedures or technical features of the electronic voting methods used in the UK for two reasons. First, many combinations of these technologies were offered simultaneously, resulting in the application of many different combinations of electronic voting systems. Second, there was no consistent framework used for each type of technology. With respect to remote Internet voting for example, the locales of Swindon Council, Liverpool Council and St. Albans Council all offered remote Internet voting to electors, but used different electronic systems with different features, operated by different providers. These differences also make evaluating these models challenging since different approaches may produce different consequences even if the same technology is being used. Additionally, it is difficult to decipher what is working and what is not when multiple channels are offered concurrently.
Despite extensive research and the fulfillment of the noted prerequisites, part of the problem with the UK trials is that from the beginning they did not allow sufficient time for testing or development given that they chose to trial so many methods of electronic voting simultaneously. Whereas most jurisdictions in other countries chose to develop and test one or two methods, the UK attempted to pilot as many potential combinations of electronic voting methods as possible, in order to identify the most effective options. Unfortunately, the amount of diversity in the trials made it very difficult for the UK Electoral Commission to determine the impact of any one method.
The Electoral Commission officially terminated all electronic voting trials in August 2007 and in 2008 the government announced that electronic voting would not be used in either the 2009 local or European elections. The continued presence of concerns in government reports regarding the underdevelopment of electronic voting systems, security and secrecy as well as the success of postal voting, and highly critical reports from other sources (the BBC and Open Rights Group) diminished support for electronic voting. Finally, a serious problem with electronic counting in the May 2007 Scottish elections led to multiple reviews and was the final catalyst to end the electronic voting projects in Britain. On the whole, the decision to halt electronic voting can be attributed to two sets of concerns, the first relating to the ability of the Internet and other electronic methods to increase turnout, and the other to security considerations (The Electoral Commission, 2007).
Second, major concerns about security and malfunctions influenced the decision to end the project. These included the possibility of hacking, viruses, lack of a paper trail, a lack of security testing prior to the trials, and breeches of ballot secrecy with door-to-door canvassers helping electors cast their ballots. Technical issues included some voting channels (such as laptops) becoming inoperable, polling cards being mailed with incorrect log-in information, and delays in the delivery of electoral registers to polls. In one municipality electors who experienced technical difficulty were not permitted to vote at traditional polling stations and so effectively disenfranchised. Most seriously, the technical counting problems that occurred in Scotland highlighted that more development and testing were needed (The Electoral Commission, 2007; Open Rights Group, 2007). Taken together, these reasons and challenges motivated the Electoral Commission and UK government to end all electronic voting projects.
Leaving aside these valid concerns about security, the electronic voting project in Britain was not given enough time to germinate or develop, and was expected to achieve too much. It appears to have failed because of the many different types of electronic voting that were introduced simultaneously and the multitude of models used to carry these out. The push for rapid implementation also imposed time constraints that resulted in best practices not always being followed and in some instances a lack of security testing (Barry et al., 2002).
36 Although passed in 2002, the legislation specified that remote Internet voting not be applied until 2005.
37 This rule was brought before the Supreme Court based on the argument that it constitutionally violated the principle of uniformity, that each citizen has the right to vote once and in a similar manner. The Court upheld the legislation arguing that electors who voted electronically still only cast one ballot and had the same effect on the final results as any other voter (Madise and Martens, 2006).
38 In the most recent set of local elections held on October 18, 2009, the number of Internet voters increased to 15.75 percent of all voters. Turnout in this election was 60.6 percent, an increase of about 13 percent from the 2005 local elections, which had a turnout of 47.4 percent (Estonian National Electoral Committee, 2009).
39 Though the Swiss constitution guarantees voter secrecy it can still be considered customary in some cantons to vote by a show of hands. This is considered to be a "soft" approach to voter secrecy as opposed to frameworks that are more strict with regard to privacy (République et Canton de Genève, 2009).
40 The legal basis for this project was established in 2002, with an amendment to the 1976 federal law on political rights (Braun and Brändli, 2006). In addition, authorities also adhered to the recommendations of the Council of Europe, which required that e-voting follow all the principles of democratic elections, and be as reliable and secure as traditional voting (République et Canton de Genève, 2009).
41 If this layer is removed on-line voting is no longer possible because the elector controls the card (Chevallier et al., 2006).
42 It also displayed a positive relationship with education and income level. That is, the greater an elector's education and income the more likely he or she was to vote on-line.
43 That said there are still questions surrounding the development of this part of Internet voting (E-voting, 2009).
44 In Estonia this was addressed by allowing the voter to update his or her ballot while the polls remained open.
45 The 'modernisation' process actually began in 2000 with postal voting trials. Although postal voting was successful in that most localities in which it was offered reported an increase of at least 50 percent in electoral participation and it improved the public's reported satisfaction with the electoral process, overall turnout declined prompting the government to expand the project and experiment with other methods (Barry et al., 2002; Norris, 2005).