Neuvote Busts Five Common Online Voting Myths

There is growing consensus that the modern electoral process needs to be advanced. Automation, autonomy, and the transition into the online world are methods that can assist this advancement, but are not the only ways we can improve the democratic process. The degree of development of electronic information technologies in the electoral process of each country depends on the overall level of its progress in the areas of politics, economics, technology, and information. The use of modern electronics and the Internet is one of the most essential and promising approaches to developing democracy in different countries, but there remains a long-held and widespread debate about the security of online voting, and we want to dispel some of the most popular myths.

Myth 1. Election security cannot be guaranteed

This is probably one of the most common myths surrounding online voting. The development and emergence of a new generation of viruses and the possibility of targeted DDoS attacks on specific servers (such as voter lists) are of some concern.

What can be done to avoid this? Our answer is to look to the experience of a successful real-world example: Estonia, the pioneer in the field of online voting.

Estonian voters have the opportunity to vote online in local and parliamentary elections. They either use a national card with a microchip or a mobile phone with Mobile-ID. Estonia, the first country in the world to introduce online voting in federal elections, has had electronic voting with mandatory results since 2005. Estonian ballots are available for an online vote on the day of the primary election, 4-10 days before the election. Therefore, it is similar to pre-voting with paper ballots.

Estonia has set up an independent body at the state level, the Electronic Voting Commission, to manage the online voting system to ensure trust in the system. This addition of a governing body and standards to operate the online voting system are two key elements that are lacking in North America. Although the online voting system was fully operational and launched nationwide in 2005, the procedure has improved. And in the decade of its existence, there has been no evidence of interference in the country's electoral process. Estonia has all but guaranteed the security of its online elections, thus dispelling this myth.

Myth 2. False identification

In an uncontrolled online voting environment, there is a risk that some actual voters with the right to vote will not be allowed to vote, and some fake voters (semi- or fully automated or real perpetrators of stolen or forged credentials) will vote even though they do not have the right to vote.

This kind of situation can be prevented by introducing several stages of reliable identification, which minimizes the risk of misidentification. Estonian residents, for example, have digital means of identification that include a combination of a "tangible" tag (identity card) and an "intangible tag" (PIN code) that provides reliable verification that the person in the system is indeed the correct person. [1]

Some might ask what if a person sells their digital identity? Possible, but it's like handing in your passport to allow someone to take out a bank loan or register a business. Even for such a misuse of digital identification, there are precautions. Another way to mitigate against this misuse is to include technology that we already accept for other forms of high indeed assurance, Liveness detection. Liveness Detection allows distinct one-voter, one-vote adherence by assuring that a person is distinct from another when they access the system.

Myth 3. Third-party intervention is possible

There is often skepticism about the impossibility of 100% truthfulness of the results of electronic voting via the Internet or electronic terminals. 100% reliability is not observed in traditional types of voting and there are many options for targeted interference in the electronic voting process by stakeholders: viruses, attacks, targeted damage to the communication line, disruption of providers, etc. Of course, this interference is costly and does not necessarily occur in the process of electronic voting. There are also trivial possibilities of electronic systems' failure: breakdowns, technical failures, communication failures, and occasionally, operating systems may stop working for unknown reasons.

To prevent these kinds of problems, long-term training is provided to identify vulnerabilities in the operating systems used during voting. For example, End-to-End Verifiability is a mechanism that allows any manipulation of the election results to be detected. This detection is accomplished by providing cryptographic proofs throughout the voting process that can be examined to ensure that the vote occurred accurately. This technology combined with cybersecurity best practices and redundancy options can both prevent and detect issues should they arise. There is always a plan "B," sometimes "C," but never just "A."

If all stages of cybersecurity are observed, mass falsification of e-election results will be virtually impossible. Moreover, the sheer number of scandals in different countries involving the use and manipulation of paper ballots to falsify election results demonstrates that online voting is not unique and that no system is ever 100% perfect.

Myth 4. The cost of setting up, maintaining, and securing online elections may outweigh the benefits

This myth isn’t completely wrong. At the beginning of the transfer from in-person voting to online voting, it is possible that it may slightly increase budget costs to purchase the necessary equipment and related programs and, on an ongoing basis, invest in creating and later updating the software. But on the other hand, establishing and manning polling stations, printing ballots, and counting votes "manually" will be reduced. This investment in the online strategy will make online elections cheaper than regular paper ones. It will also solve the problem of hiring and training workers at each polling station.

In addition, the online voting system is more mobile than polling station voting, making it easier for people with disabilities, working parents, shift workers, and the elderly to express their democratic rights. Electronic vote counting is instantaneous and does not require as many counts as traditional voting, making online voting more efficient and, therefore, more democratic. The online voting system will allow citizens outside their country during an election to vote without resorting to cumbersome mail-in absentee ballots and the controversies that sometimes result from late counting and accuracy of mail-in ballots,

Myth 5. Distorted saving and counting of votes

Electronic voting results may be distorted during the recording and counting stages. The Council of Europe has therefore made several recommendations to ensure the veracity of the results of such a vote. They decide that measures must be taken to ensure that:

1) the same number of votes cast from each voter, stored in the electronic ballot box and taken into account in the election results;

2) if a voter has the right to cast an electronic vote several times, only the last vote shall be taken into account;

3) if a voter has the right to vote using several voting methods, then only one vote is counted;

4) in all other cases - the voter may not cast more than one vote;

5) in all cases - the voter is informed about the available voting opportunities and the rules for counting votes [2].

To ensure reliable results, verification capabilities are introduced in electronic voting systems. In particular, the possibility of cross-checking using End-to-End Verifiability (E2EV) means: that "voters and potential external auditors should be able to verify that the published election result is accurate, i.e., whether it corresponds to the votes cast by voters, even if voting devices and servers have programming errors" [3]. The authors of “Cryptographic Security Analysis of E-voting Systems: Achievements, Misconceptions, and Limitations” study further clarify that individual verification is achieved when the sender can check whether the message has reached its destination, but can not determine whether this is the case for other voters. In contrast, universal verification guarantees the possibility of public confirmation of the vote count. A promising approach is that "the final verifiable voting system (E2EVV) will eradicate election fraud by allowing voters to verify that their votes were cast correctly, but also that they were correctly recorded and counted." [4]

For example, the robust Estonian voting system was attacked explicitly to falsify the election results. One malware was developed that demonstrated the ability to change or block a voice, so a voter would not notice it. In response, two advanced verification mechanisms have been created:

1) an independent mobile computing device that downloads the voice cryptogram from the storage server and roughly breaks it using random encryption obtained from the voter's computer using a QR code;

2) software hosted on a server that generates a verification code for the voter [5].

Such a protocol introduces a higher level of security, requiring the malicious cooperation of at least two parties to compromise verification or privacy.

What is Neuvote doing to counter these myths and ensure the security of online voting?

Verified Voter Management

Neuvote is in a position to verify voters' identity as they register online with ID, very similar to in-person voting. Additionally, we've Liveness Detection technology, with facial registration, that's encrypted and stored to ensure the voter eligible to vote is the one casting the ballot. This voter verification system is the only method to ensure one voter, one vote in a web or mobile voting system.

Online & Paper Secured Online Voting

Our online voting process is enhanced by our unique hybrid system that has the gold standard of elections, paper ballots, and printing of same in centralized Ballot Centers. Neuvote is the only vendor with paper ballots as part of the online voting system, with many advantages that include: a paper trail; the ability for recounts; easy audit; tamper resistance; and a format and process that is trusted and familiar to voters.

End-to-End Variability

The road to a secure and secure online election requires End-to-End Variability in which votes are cast as intended, recorded as cast, and tallied as recorded. Microsoft's Election Guard is the foundation of Neuvote's system and ensures:

• Votes are encrypted and secured
• Verifiable and accurate tallying without compromising secrecy or security
• No votes changed after being cast without being detected
• No one specific individual's vote can be revealed

Support and Disaster Recovery Planning

In addition to Neuvote's DemocraSuite Election Services, some key features in our deployment of online voting include comprehensive support for election clients, 24/7, training, a help desk and voter information guides, analytics, and on-site Neuvote technicians at ballot centers. Additionally, we offer disaster recovery and business continuity planning.

Sources

1. Hall, T. 2015. Internet voting: the state of the debate. Coleman, S., & Freelon, D. Handbook of Digital Politics. Pp. 103-117. Cheltenhaum, UK: Edward Elgar.
2. Council of Europe. 2017. Guidelines on the implementation of the provisions of Recommendation CM/Rec(2017)5 on standards for e-voting. 14 June.
3. Küsters, R., & Müller, J. 2017. Cryptographic Security Analysis of E-voting Systems: Achievements, Misconceptions, and Limitations. In: Krimmer, R. et al (eds.) Electronic Voting: Second International Joint Conference, E-Vote-ID 2017. Pp. 21-41. Cham, Switzerland: Springer.
4. Russell, M. & Zamfir, I. 2018. Digital Technology in Elections: Efficiency versus Credibility? Brussels: European Parliamentary Research Service.
5. Kubjas, I., Pikma, T., & Willemson, J. 2017. Estonian Voting Verification Mechanism Revisited Again. In: Krimmer, R. et al (eds.) Electronic Voting: Second International Joint Conference, E-Vote-ID 2017. Pp. 306-317. Cham, Switzerland: Springer.