Sunday, December 22, 2013

Norway has Second Great Success with Internet Voting

The Organization for Security and Co-operation in Europe (OSCE) has just released its Final Report on Norway’s Parliamentary Elections for 2013.1  This was the second time Norway’s Parliament permitted Internet voting on a trial basis. Authorization was given again because Norway’s 2011 Internet voting trial went so well, as reported on this blog here and here  This year’s election was held in August-September, and the OSCE Report came out on December 16.  The Ministry of Local Government and Regional Development (“MLGRD”) is the primary government agency for administering elections in Norway, and the Report is essentially a review of its job performance. A summary of the Report’s findings follows.

Use of Internet Voting more than Doubles
In both 2011 and 2013, Internet voting was offered for early voting2 for nearly a month prior to Election Day, which was on September 9th this year.

17% of registered voters in the pilot districts voted online in 2011.  But the Report states that in this year’s 12 pilot districts, “36 per cent of registered voters voted over the Internet.” (p13)  That is more than a 100% increase in the use of Internet voting.  Since there were about 250,000 eligible voters in these pilot districts, approximately 90,000 voters voted online. (p7)

According to Christian Bull, a senior official in MLGRD, online voting increased as Election Day approached, and evenings were the preferred time for voting.3

Paper Ballots Delayed in the Mail
Norway also provides a vote-by-mail process for early voting and for overseas voters. Oddly, overseas voters did not have an Internet voting option.  A scandal erupted, and an investigation promised, when the press reported that “several hundred ballots,” from both domestic and overseas voters, arrived at government counting centers too late to be counted. (p13) There were NO reports of late or lost online votes.

Voter Verification
When voting, voters select candidates from a list. (p5)  Votes could be cast online by tablet or PC, as well as on paper. Each vote was encrypted in such a manner that it couldn't be tied to the voter's identity.

Voters using electronic means could verify that their vote was counted as cast via “return codes.” Each voter was mailed a polling card with instructions on how to vote and a unique four digit return code. Voters logged on, entered their identification, and were then guided through the voting process. After submitting a vote, voters received a return code electronically. If that code matched the one on their polling card, the voter could be assured that his or her vote was counted as cast. “Completing this verification step was not necessary in order to cast a vote.” (p8)

Christian Bull reports that there were some calls to the support line about non-matching return codes. Usually the problem was that the voter mistakenly used the polling card of a family member, rather than his own, to check the return code.

Only Final Vote Counts
Online voters could vote as many times as they liked, but only their most recent vote would be counted. This option was intended to mitigate the risk of voter coercion or vote buying.  Because polling places used an electronic poll book, an online voter could also cast his or her last vote on paper and immediately cancel prior votes. “The municipal authorities evaluated this process very positively, commenting that it simplified procedures.” (p6-7)

Transparency and Third Party Auditing
The latest code for every voter was also sent to a public web page, hosted by GitHub (without, of course, any vote or voter information). On Election Night an independent third party verified that the content of the digital ballot box matched the list published to GitHub. The third party also verified the integrity of the entire counting process, even checking the various mathematical proofs of integrity provided by the system. (p9)  “Experts on electronic voting,” consulted for the Report, “expressed satisfaction with the mechanisms to verify the integrity of election results and safeguard the secrecy of the electronic votes.” (p7)

For the Internet voting, MLGRD developed and hosted its own servers, and made itself the IT-provider for local election administrators, rather than contracting an outside vendor. However, to check itself, it hired an independent auditor to verify the operations of the Internet voting process.

A few days before the end of early voting MLGRD frankly announced that the auditors had found “a programming error that caused weak encryption in some 29,000 electronic votes. As a result, system administrators with access to the electronic ballot box could potentially decrypt the ballots without the need for the secret decryption key.” (p8)

To address this problem, MLGRD quickly corrected the software “and tightened access restriction to the servers holding the electronic ballot box by requiring a written authorization each time servers were accessed.” (p8) After discussing the issue, election authorities agreed that there was no violation of secrecy, and the integrity of the votes had not been violated. The Report noted that the reviewing experts agreed “the MLGRD’s action was sufficient.” (p8)

Prior to the election, MLGRD posted the voting source code on its website for anyone to inspect.  But even the nay-sayers have found no scandals to reveal.

High Levels of Trust
The Report also stated that the Internet voting system “enjoyed a high level of trust among [the Report’s] interlocutors, reflecting the overall trust in the electoral process and in the MLGRD to organize the process professionally and impartially.” (p6-7)  As a further example of that trust, the Report observed that although MLGRD expressed willingness to allow political parties and other groups to have their own experts inspect the system, they “showed no apparent interest.” (p7)

This widespread trust is justified because, as in 2011, there were NO reports of attacks on the Internet voting system, such as by spoofing or denial of service attacks.

No Political Bias in the Voting Technology
Anyone who worries that Internet voting technology favors liberals over conservatives will be put at ease by the results of the 2013 election. The incumbent government was a Red-Green coalition led by the Labor Party. But it was handily ousted by a center-right coalition led by the Conservative Party.

Conclusion
Why are Norway’s Internet voting trials important for observers in the USA?  Because nothing overcomes fear more effectively than knowledge based on experience. That is what Norway can provide the US.

Pilot programs, like those in Norway and the one in WestVirginia in 2010, will give voters confidence that the technology can be used securely when the process is managed by competent professionals.

Norway’s 2013 trial made the technology available to about 250,000 voters. (That is a fraction of its 3.6 million voters in total.) Internet voting in the US will emerge county by county, and district by district in the 50 states.  Many American pilot projects will be similar in size to those in Norway. Seeing that it has been done well elsewhere will encourage Americans to feel confident that it can be done well here, too.

The way to online voting in the USA is to spread the news of successes, and to be sure that your state and local elected officials know the facts when you demand that your state and local election system be brought into the 21st Century.

Notes:
1. The Final Report is available for download at,
http://www.osce.org/odihr/elections/109503  It focused on the Internet voting pilot project, the electronic election administration system, and the political party finance regulations. This post is primarily concerned with the online voting pilot.

2. Technically, Norway election law distinguishes between “advance” and “early” voting. The main difference is that early voters are not able to mark preferential choices among candidates on their ballots.  (Report, page 13, note 26)
3. Private communication
******************************
William J. Kelleher, Ph.D.
Political Scientist, author, speaker,
CEO for The Internet Voting Research and Education Fund
Twitter: wjkno1

Author of Internet Voting Now! 
Kindle edition: http://tinyurl.com/IntV-Now