Paper Vote Canada

The City of Hamilton has posted a report about "alternative voting" for the General Issues Committee on September 21, 2016, 9:30 AM.

(Many cities in Ontario will be producing such reports in advance of the 2018 elections.)

You can see the agenda, and the report is discussion item 8.4 Alternative Voting Options (CL16010) (City Wide).  To get a permanent download link you have to get the link from the file icon on the right, after clicking on item 8.4.

Here's the link to the report itself: http://hamilton.siretechnologies.com/sirepub/view.aspx?cabinet=published_meetings&fileid=157256 (PDF)

(You have to know how to navigate the SIRE public documents system, for which I must say Hamilton has a particularly poor implementation.)

The report is fairly typical for a city staff report, which is to say a lot of assertions without any citations.  Let's have a look starting on page 5, Internet Voting

Experts are divided as to the use of internet voting. Those in opposition site [sic.] the opportunity for attacks, viruses, lack of a ballot audit trail, or denials of service.

No.  Experts are not divided.  Find me the 50% of computer security experts who strongly endorse Internet voting.  The reality is the vast majority of computer security experts, and indeed the larger computer science expert community, is opposed to online voting until a number of extremely challenging technical requirements can be demonstrated conclusively to be resolved.  This consensus is so strong that the US Association of Computing Machinery, the largest organisation of computer scientists, has a consensus recommendation against paperless voting tabulators and against internet voting entirely.  (This in a world where it is usually difficult to get scientists to agree on many things.)

An example of a denial of service occurred at an N.D.P convention where electors were prohibited from voting due to a restrictive program put in place by an outside source.

This is awkwardly described, but it is true.  The NDP used online voting and experienced a denial of service attack.  In fact they've had technical problems in 2003[1] and in 2012[2][3][4].  It's also worth noting that they used third-party, for-profit companies for the voting.

[1] CPAC Special - NDP Federal Leadership Convention – January 25, 2003 (Part 3 of 17)
[2] Toronto Star - Internet voting carries risk as show [sic.] by NDP experience - by Michael Geist - March 31, 2012
[3] iPolitics - NDP cyber attack a warning to stay away from Internet voting: expert - by James Munson - April 14, 2012
[4] Huffington Post - NDP Denial of Service Attack

There have also been technical problems in many many other uses of telephone and online voting for political parties in Canada, which doesn't seem to stop any of them from continuing to use these flawed technologies.  Notably, there were reports of hacking in the 2014 Alberta PC leadership election.  "Police may be called in to probe the suspected hacking of the online voting system used to elect Jim Prentice as Alberta Tory party leader and premier-designate, a senior party official said Sunday."[5]

[5] Calgary Herald - Hacking of online voting - by Darcy Henton - September 8, 2014
 
It is perhaps not surprising that Hamilton would cite the NDP 2012 incident, as they cited the exact same incident in their 2012 report Alternative Voting Solutions for Municipal Elections (FCS12046).  In fact, the 2016 report is just a slightly updated version of the 2012 report.

These incidents cited are, however, relatively minor in the grand scheme of things.  What people should be much more concerned about is that Canadian federal government departments have been repeatedly, severely, successfully attacked.  Including departments with sophisticated technical capabilities.

An example of an attack was an internet voting program test conducted by the City of Washington, D.C. that was reprogrammed by University of Michigan students to play the Michigan fight song.

This is a good example, it was work done by J. Alex Halderman and his team of students.  You can see him report on it from 7:11 to 14:02 in the video of his USENIX Enigma 2016 talk Internet Voting: What Could Go wrong? and also read his paper about the attack and the accompanying materials

Attacking the Washington, D.C. Internet Voting System (blog post, testimony, video)

For an even more extensive overview of these kinds of vulnerabilities, read his book chapter Practical Attacks on Real-world E-voting (PDF).

Note that this is one of the very rare times that a jurisdiction has allowed a public hacking challenge.  Every time a public hacking challenge is opened, vulnerabilities are found.  Most importantly, the third-party, for-profit companies that are used in Ontario municipal Internet voting have never permitted a public hacking challenge or indeed any meaningfully extensive independent security audit.

Overall municipalities using internet are finding that although the voting on advance polls has risen significantly, the overall percentage of voters has either remained the same or showed a slight improvement in numbers.

Online voting never substantially increases turnout.  And contrary to the perception that it will increase voting by younger and disadvantaged voters, in an extensive study of Ontario's municipal online voting, Dr. Nichole Goodman finds that "The typical online voter is older, educated and wealthier."[6]

[6] Internet Voting Project - Executive Summary (PDF) - August 2016

It is also important to understand that Dr. Goodman is a social scientist, doing a survey-based analysis of satisfaction with online voting.  She is not a computer scientist and has not done an examination of the security of the voting systems.

Hamilton Pro/Con

Pro and Con taken from their report.

Pro: Possible increase in voter turnout.

There is no substantial increase in voter turnout.  In the only example of national online voting, Estonia, after 9 years of offering online voting their turnout is lower than Canada's in the last election.

Con: Ability for others to influence how an elector is to vote.

This risk, the risk of voter coercion, is a significant one and one that has nothing to do with technology, it has to do with the fact that the casting of the vote can be observed.  I devoted some time to this risk in my presentation on online voting as often overlooked.  I don't see any good way to reduce this risk for online voting.  In case you think it is minor, at any time in history when votes could be easily coerced, they were coerced.

Con: Hacking, viruses or denial of services. (Average age of a hacker is 18-22 and they do it as a challenge.)

Hacking is definitely a serious consideration.  Most significant is the fact that online voting involves casting votes from a personal computer or smartphone.  Many millions of personal computers and smartphones are already known to be compromised by various types of malicious software.  The second part is kind of funny in its misunderstanding of hackers.  Anyone can be a hacker.  By far the two most serious threats are criminal gangs, who conduct very sophisticated attacks, most recently involving ransomware[7], and countries with professional hacking teams ("nation-state attackers") who have the time, money and expertise to compromise almost any system[8].  Comparing the basement script kiddie hacker to a nation-state team of attackers is like comparing a BB gun to a bunch of missile launchers.

[7] CSO - A single ransomware network has pulled in $121 million - by Maria Korolov - September 14, 2016
[8] Information Week - Dark Reading - Nation-State Cyberthreats: Why They Hack - by Mike Walls - January 8, 2015

The threat of nation-state attackers is in fact so significant that the US has raised the possibility of classifying election technology as critical infrastructure [9], and the US Department of Homeland Security recommends against online voting, stating “We believe that online voting, especially online voting in large scale, introduces great risk into the election system by threatening voters’ expectations of confidentiality, accountability and security of their votes and provides an avenue for malicious actors to manipulate the voting results."[10]

[9] New York Times - U.S. Seeks to Protect Voting System From Cyberattacks - by Julie Hirschfeld Davis - August 3, 2016
[10] Washington Post - More than 30 states offer online voting, but experts warn it isn’t secure - by Sari Horwitz - May 17, 2016

In light of the above, I support the City of Hamilton staff recommendation, which is silent about Internet voting (i.e. does not recommend the use of Internet voting for the 2018 election).

Also note that the City of Toronto did a security analysis of Ontario municipal Internet voting options (PDF) and the report concluded that none of the systems met the security requirements (even for the limited amount of security analysis they were able to conduct on the third-party, closed-source, for-profit commercial systems).  Kudos to Toronto for hiring computer scientists to conduct an expert study.

In addition, Quebec has had a moratorium on electronic voting since a debacle with their machines in 2006, BC's Independent Panel recommended against Internet voting and when Australia did an extensive Parliamentary investigation with 20 hearings and over 200 submissions, they concluded that electronic voting would catastrophically compromise election integrity.

For vote tabulators (vote counting machines), they are acceptable if they are mark-sense paper ballot scanners.  Ideally with extensive auditing including random testing on election day, by pulling machines out of service to test them (unfortunately almost no jurisdiction actually does this). If the majority of votes is cast instead on touch screen, this is unacceptable.

Previously:
August 22, 2016  City of Kitchener 2012 report on Internet Voting
June 23, 2016  City of Mississauga report on Internet Voting

Labels: hamilton, internet voting, online voting, report

The City of Kitchener did a report in 2012, titled FCS-12-191 Alternative Voting - Internet Voting (link will open a page viewer).

Because the City of Kitchener website provides a page viewer and a button to generate a PDF download, I've made a copy of the PDF, you can view and download it from Google Drive (click the down-pointing arrow in the upper right of that screen to download).

The report is particularly good is in the area of turnout.  It concludes

there is no clear indication that [internet voting] increases voter turnout. There is data that shows internet voting does not increase voter turnout amongst younger voters. 

The conclusion is supported by tables in the Results and Outcomes section showing data from Markham, Peterborough, and Burlington, with a particularly detailed breakdown for Markham.  See the image extracted from the document below:


Let me re-emphasize the last sentence in the above extract:

There is clear evidence that, regardless of geography internet voting does not attract younger voters.

I believe it is the Markham evidence that underlies the Canadian Internet Voting Project's (@ivotingproject) October 31, 2015 tweet stating "Young ontario voters (aged 18-24) more likely to use paper ballots than internet voting"

Young ontario voters (aged 18-24) more likely to use paper ballots than internet voting #election #onlinevoting

— i-voting Project (@ivotingproject) October 31, 2015

The Kitchener report however unfortunately comes to an incorrect conclusion about security "Security issues are a real threat but most studies conclude that the risk is small to medium." The reality is most studies conclude the risk is large.

The staff report's Executive Summary recommended against adopting Internet voting and indeed Kitchener rejected Internet voting for 2014.

Executive Summary (extract)

Staff is of the opinion that [internet voting] should not be introduced in 2014 based on several factors outlined in greater detail in this report such as:

• Security of an internet voting system;
• Data that suggests it does not increase voter turnout and in particular, younger voters;
• Does not meet all of the principles of a democratic voting process;
• Cost;
• The lack of overarching guidelines especially in the area of voting system security;

Previously
June 23, 2016  City of Mississauga report on Internet Voting

Labels: #CdnDemocracy, #ERRE, internet voting, Kitchener, online voting, ontario, report

In my understanding, Australia does a review of election processes and possible improvements after every election.

Canada should be so lucky as to have a process as comprehensive as Australia's last review in 2013, where "The Joint Standing Committee on Electoral Matters held 20 hearings and reviewed more than 200 submissions, before deciding Australia should stick to its largely paper based system."[1]

The foreward of this Joint Standing Committee on Electoral Matters (JSCEM) report is worth quoting extensively, as it is clear and compelling.  Any emphasis (bolding) below is mine.

advocates argue that [electronic voting computers and Internet voting] offer faster and potentially more accurate results. With the close of polls the results are known within minutes rather than hours, days and weeks and arguably without the human error that occurs in the long paper ballot count.

Many think it sounds like a good idea for the next federal election.

No matter your view, this is not feasible.

Even the most ardent electronic voting advocates must recognise that in logistical terms it would be impossible for our electoral authorities to roll it out next polling day which is less than two years away – at the latest.

But what about future elections?

I once simply assumed so, but that was before I had really given it a lot of thought.

After hearing from a range of experts, and surveying the international electoral landscapes it is clear to me that Australia is not in a position to introduce any large-scale system of electronic voting in the near future without catastrophically compromising our electoral integrity.

Machine electronic voting at a polling place is vulnerable to hacking to some degree. This can be mitigated by a system that not only records your vote electronically, but also produces a printed ballot for physical counting and later verification. In other words, a lot of expense to still visit the polling booth, queue up and complete your vote on a machine rather than a paper ballot.

For this reason, internet voting seems to be naturally the most attractive to many voters. As an election expert from the USA recently said to me: ‘when it comes to voting, folks would rather be online than in line.’

But the weight of evidence tells us that at present [Internet voting] is highly vulnerable to hacking. While internet voting occurs in Estonia, it does not mean that system cannot be hacked.

With all the internet security architecture available, the academic experts swear they can, and have proved they can, hack such systems.

...

Given we complete so many transactions online, I am often asked why voting should be any different. My answer to that is that voting once every three years to determine our democratic destiny is not an everyday transaction.

Not only do we have the right to a ballot; we have rightly enshrined within our system the right to a secret vote. Voting at a booth in a polling place guarantees this; voting over the internet threatens this.

Internet voting would expose some voters to family and peer pressure by removing the individual isolation of voting at a secluded booth and replacing it with voting in a home, a workplace or a public place. It also potentially opens up a market for votes where disengaged or financially desperate voters could be offered money to vote a certain way, which could be verified in a way not possible at a polling place.

...

Over the course of the twenty hearings to date and in reviewing the 207 submissions received, the Committee has worked collaboratively and in an impartial manner to ensure that the best outcomes have been met.

Technology is moving at a rapid pace. The Committee believes that we should be utilising it to ensure that the systems underpinning how we vote are sound and that persons with disabilities have easy access to the vote. In doing so, we will harness [technology] which enhances our electoral integrity, not that which endangers it.

I extend my thanks once again to the Honourable Tony Smith for such a clear and compelling summary of the evidence.

[1] ABC - Curious Campaign: Why have voters not had access to electronic voting? - 26 May 2016

Labels: australia, electronic voting, internet voting, online voting, report

A good, clear report about Internet voting from the City of Mississauga has been posted.

Potential enhancements for the 2018 Municipal Election: Internet Voting, Ranked Choice Elections and Vote Anywhere. (PDF)

It includes both an summary section (pp. 14-17) and an appendix on Internet voting specifically (pp. 18-23).

Some key highlights (selected by me):

Executive Summary (selected items)

• Statistics indicate that internet voting does not increase voter turnout or youth participation.
• The risks to the integrity of an election offering remote internet voting include: electronic security, authentication of elector identity, fraud and equipment failure.
• Internet voting requires a significant financial investment of approximately $1.1 million

Some additional key quotes:

 "there are risks to be considered. Subversive internet activities continuously evolve in frequency, unpredictability and complexity and may threaten the integrity of an Internet Voting system." - page 15

"The academic community generally agree that there is no guarantee that the transmission of ballots through the internet is secure.

Election officials have no control over the security of the internet devices used by electors to vote remotely. An elector may unknowingly be using a device that has been compromised with illicit software that may direct him/her to a fraudulent election site, duplicate his/her personal information, change his/her vote, etc." - page 19

Unfortunately there are no citations, but that is not unusual for a municipal report.

Thanks to Rachael Williams for her article about the report and the Governance Committee debate about it in the Mississauga News - Mississauga won't use ranked ballots until province implements reform: Governance Committee, and for sharing the link to the report with me in response to a question.

Labels: #CdnDemocracy, internet voting, mississauga, online voting, report