Safety, cost and desirability
4.32 The main concerns with electronic voting relate to:
safety, including the security, integrity and transparency of the system;
cost of delivering a safe system;
desirability of electronic voting, including:
Safety of electronic voting
4.33 The safety of electronic voting systems is often simplified into the physical security of a voter, the vote cast and the safeguards attached to data transmission or storage of the vote once cast.
4.34 However, there are more complex interconnections between the security of electronic voting (as evidenced in the criticisms of international systems in Chapter 3), the integrity that a voter perceives in the system in which they are voting (both through tangible security measures and the psychological value that a voter places on the method used to cast their vote), and the transparency and visibility that must accompany any voting system, to ensure that all stakeholders can believe the veracity of the outcome.
4.35 Ultimately, the voter’s perception of the voting process as a whole, and their acceptance of the process as ‘safe’, will dictate the success of any electoral system and the confidence voters have in the resultant government. The question that remains is: is this safety undermined in the current Australian system and can it be addressed wholly and satisfactorily by electronic voting, or will electronic voting introduce new and greater safety concerns?
Security and integrity
4.36 Public confidence in the security and integrity of any voting system is integral to ensuring confidence in election outcomes. The international examples outlined earlier in this report highlight the fact that, even though the technology currently exists to provide for electronic voting, the integrity and security of such systems can be vulnerable. In the case of Estonia’s remote internet voting system, an independent analysis recommended discontinuation of the system due to fundamental security and data integrity flaws.
4.37 Proponents of electronic voting have cited the widespread use of secure online banking. But these systems, along with government systems, are not impervious to attack:
Electronic security breaches on important government and financial infrastructure are common. For example, last month an attack on a government website in the US state of Oregon caused “elections and business databases to go offline”. The attack was described as “an orchestrated intrusion from a foreign entity” (Zheng, 2014). In 2012 a sophisticated Trojan stole € 36 million from European Internet banking systems (Kalige & Burkey, 2012). Even more concerning are stories of systematic compromise of Internet sites and infrastructure by the Chinese People’s Liberation Army (Mandiant, 2013) and the US NSA. Last week it was revealed that half a billion dollars’ worth of bitcoins had been stolen from one of the world’s largest bitcoin exchanges (Sydney Morning Herald, 2014). Electronic voting systems would not be immune from such attacks. Indeed, Internet voting is harder to secure (for privacy reasons) and has higher stakes than most other Internet applications (Jefferson).17
4.38 This supports the argument that even if internet voting was completely secure at a given point in time, this would be no guarantee of future security as it is difficult to anticipate the future capability of those wishing to mount attacks.
4.39 Internet voting is considered by experts to be the most risky and difficult mode of electronic voting to implement. Even if it were to be demonstrated that voting over the internet could remain secret, in the future there is no guarantee that, given the pace of technological advancement, a person’s past voting record could not be observed. With paper ballots the secrecy of the vote is guaranteed on polling day and forever thereafter.
4.40 Professor Rajeev Goré, of the Research School of Computer Science at the Australian National University was blunt in his assessment:
First of all … internet voting is just too dangerous. Don't do it. It is as simple as that.18
4.41 It is important to recognise the distinctiveness of voting as compared to other activities, transactions or services conducted over the internet. Almost every information and communication technology (ICT) application is built in a way that allows for verification of its proper functioning by observing the application’s outputs. 19 This verification process is crucial to gaining user confidence in the system. For example, online banking allows the user to log in, see up-to-date information relating to their account and monitor their transactions.
4.42 This type of verification process presents a problem for internet voting, because our democratic system seeks to maintain the individual’s right to the secrecy of their vote. This means separating the identity of the voter from the vote cast, which inevitably makes verification—the hallmark of all other trusted ICT technologies—difficult. Breaking the link between voter and vote means that the examination of an internet voting system after an election cannot prove directly that every vote was indeed counted and tallied as cast.20
4.43 In relation to isolated static electronic voting, the Australian Capital Territory (ACT) electronic voting system is an example of how physical security can be maintained by isolating terminals and ensuring they have no connection to any other network, therefore reducing the avenues for compromising data. The ACT Electoral Commissioner outlined the security basis for the ACT system:
we have decided to … opt for something that is entirely self-contained and entirely wired within the polling place. So it uses a computer that is a server in the polling place that is in a locked cabinet. The voting clients are all connected by ethernet cables, and one of the conscious decisions we made was to make it very difficult to be able to remotely get into the system. So you would have to actually physically get into the server in a locked box in a locked polling place in order to have any means of getting into the system itself.21
4.44 This form of physical security isolation is a strong attempt at controlling potential manipulation, but many people have access to the machines at different stages during an election, so the opportunity for the manipulation of machinery, firmware or software still exists. 22 This security is also dependent on the provision of physical voting terminals, which would be a cost-prohibitive method of introducing electronic voting across Australia for federal elections. Even in a jurisdiction as small as the ACT, universal implementation of electronic voting is constrained by the cost of providing access at every polling booth.
4.45 One response to potential issues with integrity and security in relation to isolated static electronic voting is to introduce accompanying paper trails. The systems most commonly used internationally rely on paper trails to mitigate public distrust and verification problems.
4.46 As noted in Chapter 3, in 2002, for example, United States (US) electoral authorities made a large investment in e-voting machines. 23 This became problematic, however, due to the rapid adoption of electronic-only systems that lacked any manual verification, and by 2008 many states required paper trails to ensure the veracity of votes cast and greater transparency in the system, with the result that many of the machines originally purchased were rendered obsolete. As of 2010, 40 states had moved towards requiring paper trails.24
4.47 The introduction of paper trails makes systems more complex and expensive, which is not ideal. In addition, implementing paper trails to facilitate the building and maintenance of trust in the system (for example with proper audit processes and mandatory random sample recounts) could be said to somewhat defeat the purpose of moving away from paper ballots.
4.48 Any electronic voting system must be fully open to scrutiny to ensure confidence that votes are being recorded and tallied correctly. With a paper ballot system, all handling of ballot papers from printing to final storage can be observed. This becomes more difficult with an electronic system because a person cannot easily observe the computer’s processes.
4.49 Permitting public scrutiny of software source code is one way of ensuring transparency in an electronic voting system:
Computerised voting systems, including their source code, all documentation and reports, and the associated physical security procedures should be available to e-voting and security experts and the public. Source code availability should be enhanced by enough support for compiling, running and understanding the system. This level of transparency should be an enforced condition of the initial tender and contract …
Having the open source available to the community for technical review by a range of interested experts will increase transparency and trustworthiness of the electronic voting and counting process, because it facilitates an open and scientifically informed discussion about the merits of a proposed system.25
4.5 While such access to source code may enable expert review and discussion, it would also open a system to scrutiny by entities with malicious intent, requiring a balance to be struck between security and transparency.
4.51 Ownership of the technology or intellectual property is also relevant here. It may only be possible to ensure public access and scrutiny if the technology or intellectual property is not owned by a private corporation that has an interest in protecting proprietary software. There is also the potential for commercial or political influence on a supplier to undermine transparency and accountability. In terms of electronic voting in Australia, these types of factors would suggest the desirability of the AEC developing its own system.
Cost of electronic voting systems
4.52 An important factor to consider in the delivery of elections is whether the cost and cost-effectiveness of electronic voting is a significant barrier to its implementation.
4.53 Quantifying the potential cost of electronic voting in the Australian context is very difficult, given the limited history of electronic voting delivery at a federal level in the past. Using a ‘cost per vote’ measure, the current trials of electronic voting at a federal level are not cost-effective.
4.54 As outlined in Chapter 3, the 2007 trials of electronic voting for deployed Australian Defence Force (ADF) personnel and voters with Blind or Low Vision had considerable costs attached:
4.55 The total cost of the 2013 election, excluding the WA re-run Senate election and the cost of public funding, was $132 906 303.27 Based on the House of Representatives voter turnout of 13 726 070,28 this equates to roughly $9.68 per vote.
4.56 Universal implementation of static electronic voting is simply not cost effective. Even where an investment has been made in static voting, scalability does not reduce costs. Despite the small electoral area within the ACT, the deployment of electronic voting to all polling places is not proposed simply due to costs:
the deployment of the required hardware to polling places for a single day poses logistical challenges and is of questionable cost effectiveness.29
4.57 As discussed in Chapter 3, the development of the universal static electronic voting system in Ireland cost over €54 million (approximately A$78 million). The up-front purchase of the machines is not the only cost, but the total cost of ownership, including review, software upgrade, maintenance and replacement is significant. These ongoing costs contributed to Ireland abandoning electronic voting.30
4.58 Other electronically-assisted voting (non-static) is more cost-effective. The NSW iVote system (outlined in Chapter 3) used in the 2011 state election had an average cost per vote cast of $74 compared to an average cost of all votes cast of $8. This cost per vote reduces significantly as the system is scaled up to 200 000 voters using the system, with an estimated average cost per vote being approximately $24.31
4.59 The capacity to utilise this system in local government elections also further reduces the cost and is considerably more cost effective for delivery of services to blind and low vision voters than previous methods used (braille ballot papers).32
4.60 Nonetheless, there are questions about the security of the NSW iVote system and the capacity for its use in federal elections. In addition, the experience in international jurisdictions outlined in the previous chapter also makes clear that any electronic system needs to have an associated verifiable paper trail. This not only duplicates the voting process, but increases the cost of electronic voting systems to the point that they are not cost-effective.33
Desirability of electronic voting systems
Secrecy of the vote
4.61 A significant concern in relation to electronic voting is the manner in which such technology may undermine the secret ballot, particularly in relation to internet voting.
4.62 The Australian Constitution requires that both houses of Parliament be elected ‘directly chosen by the people’ and the secrecy of the ballot was enshrined in the first Electoral Act of 1902, and remains in section 233 of the Commonwealth Electoral Act 1918.
4.63 In addition, the secret ballot is a fundamental principle of a democratic society that is enshrined in the Universal Declaration on Human Rights (Article 21(3)):
The will of the people shall be the basis of the authority of government; this will shall be expressed in periodic and genuine elections which shall be by universal and equal suffrage and shall be held by secret vote or by equivalent free voting procedures.34
4.64 This right, and the protection of it, also underpins electoral administration bodies such as the AEC:
Traditionally, the one real role of an electoral administration body like the AEC is to provide a safe, secure place where individuals can go and cast a vote without anyone looking over their shoulder or coercing them in casting that vote.35
4.65 Internet voting removes the guarantee of a secret ballot, exposing voters to a greater risk of influence. This influence may not be malicious (it may be family based, for example a grandchild voting on behalf of a grandparent uncomfortable with technology and affecting their voting intentions), but nonetheless, it diminishes the secrecy of the ballot:
The argument basically is that people value their civic role, their civic duty. That is very important for people and they take it very seriously. When they are voting in a public place they will honour their civic duty and they will vote according to their true preference. However, the reality is that for a very large proportion of the population their civic duty comes second to their familial duty, their duty to their family. If they have to choose, they will put their duty as a spouse, a father, a son, a mother or a daughter above their civic duty. That is not something on which I particularly have a view. I see it as a reality. I think it is unrealistic to expect people to put their civic duty above their duty within the family.36
4.66 In some US states that allow internet voting for members of the armed forces deployed overseas, the risk of compromise to the secret ballot is so high that:
some of the 30 or so states that allow Internet voting for service members now require them to sign a form saying they understand that by using the system, their ballot may not be secret.37
4.67 The State of Alaska warns voters returning their ballot through its ‘Secure Online Voting Solution’ that:
When returning the ballot through the secure online voting solution, your [sic] are voluntarily waving [sic] your right to a secret ballot and are assuming the risk that a faulty transmission may occur.38
4.68 In addition, as noted in Chapter 3 and above, online voting systems have been found to be the most risky and vulnerable, raising questions about the secrecy and veracity of the vote. Indeed, it has been reported in the US that:
The National Institute of Standards and Technology, at the direction of Congress, has conducted extensive research into Internet voting in the last decade and published several reports that outline all the ways votes sent over the Internet can be manipulated without detection. After warning that there are many possible attacks that could have an undiscovered large-scale impact, the institute concluded that secure Internet voting is not yet achievable.39
4.69 The only way to guarantee a secret electronic vote is through the use of isolated static electronic voting machines. These have massive upfront and ongoing maintenance costs and evidence from international jurisdictions, particularly the US, indicates that they need to be accompanied with a verifiable paper trail—something which somewhat defeats the purpose by merely replacing pencils with touchscreens or buttons.
Effect on voting culture, voter behaviour and confidence in the electoral system
Voting culture and voter behaviour
4.70 Proponents of expanding electronic voting options can underestimate the value that many members of society place on the act of voting and the historical significance that this democratic process embodies.
4.71 The Parliamentary Library has captured this concept well:
In representative democracies, voting for members of legislatures is a foundational activity, and the methods, traditions and dynamics that characterise that voting act are usually a distinctive—and often cherished—element of the political culture that exists in the country or jurisdiction concerned.40
4.72 The 2001 joint report of the AEC and the Victorian Electoral Commission on electronic voting identified issues relating to electronic voting that extend beyond its technological merits:
The technical barriers to wide spread implementation of e-voting are considerable. There are also the democratic issues of secrecy of the elector’s vote, equal access to e-voting by voters and public confidence in the system.41
4.73 The AEC has previously noted the importance of garnering public support and maintaining the strong voting culture in Australia in relation to introducing electronic voting:
There is no evidence to suggest that there is any political or community support for changing the voting systems presently used in Australia. This is an important point to appreciate when considering the possibility of introducing any form of electronic voting in this country. In our view, the introduction of any form of electronic voting must support the present voting systems and voting culture.42
4.74 While the voting culture using paper ballots in polling booths is strong in Australia, the events of the 2013 election have affected this support, and, as noted above, electronic voting has been suggested as a solution. Electronic voting is also considered by many to be the next step in ensuring the ongoing accessibility of the electoral process.
4.75 There is emerging research which suggests that electronic voting may have a detrimental effect on voting behaviour. 43 Research also indicates that the element of ritual involved in the act of voting at a public polling place plays a role in sustaining people’s sense of shared civic engagement and confidence in their democracy. In this context, a shift to electronic voting may downgrade the social significance of voting:
Not only will e-voting fail to reverse electoral apathy, it will actually lead us in the wrong direction. Voting is more than the simple act of indicating one’s political preference. It’s a vital public ritual that increases social solidarity and binds citizens together. …
So, if everybody will be able to e-vote, and if e-voting is essentially fraudproof, what could be wrong with it? The problem is that e-voting will transform voting, an inherently public activity, into a private one. Even with the secret ballot, the mechanics of voting are still explicitly designed to remind us that, in principle, we are all equal members of a political community. On Election Day, we must leave our homes and offices, travel to a polling place, and physically mingle with people who are plainly our equals that day, no matter what other differences we have. Voting, as we currently do it, is a civic ritual, however brief it may be.
This ritual is valuable not just because it makes us feel good about ourselves. It also gets us to think about public issues differently than we would do otherwise. While it’s generally assumed that people vote on the basis of their pocketbooks, surveys show that most people actually focus on things such as the national good, not their narrow self-interests, when they vote. One possible reason for this: when people are obliged to leave their homes and enter the public sphere, as they do when the vote, they tend to become more public minded.
E-voting, then, might aptly be called “voting alone”. If our era is a time of citizen disengagement, of staring at screens and passing in and out of our gated communities or apartment fortresses as we wave to private security personnel, then e-voting from home is all too congruent with the spirit of the age. Far from enriching democracy, e-voting pushes us towards political anomie.44
4.76 Professor Graeme Orr of the University of Queensland also cautioned against the widespread adoption of electronic voting because of the wider democratic participation opportunities that election day affords:
Electronic voting, I hope, is not on the cards for reasons of cost, practicality, equity and ritual. Internet voting is hackable and would require a ‘reinvent the wheel’ paper trail. Computerised voting at polling stations would involve a very large outlay; be less fail-safe than paper ballots in some ways, given how our elections depend on thousands of part-time citizen employees; and computerised voting and polling stations may be impossible to deliver equally in many rural areas. In any event, paper ballots allow genuine and meaningful participation by thousands of citizens as scrutineers. It also lets those who want to protest in a compulsory system to scribble on the ballot as a form of participation, which is important.45
Confidence in the electoral system
4.77 As the 2013 election has highlighted, when errors occur in the voting system, it undermines public confidence not only in the electoral process, but in election outcomes. Errors, problems or irregularities in an electoral process will always have the effect of undermining public confidence, whether the voting system is paper-based or electronic:
But I think the underlying issue with both of those is that when something goes wrong with any type of voting system—it does not have to be electronic voting—it undermines confidence in the electoral process. It can take a very long time for confidence to recover. We saw this in Florida, in the United States, after the 2000 elections where surveys showed that people still had perceptions that there were many problems with the elections there. After postal voting on demand was introduced in the UK in the 1990s we found similar problems with postal vote fraud that created a perception of poor-quality elections in the UK. Only about two-thirds of British people think the elections are fair and that is a dramatic decline compared to previous rates.46
4.78 Some of the international examples of electronic voting systems cited in Chapter 3, together with security, integrity and transparency concerns more generally, are highly relevant in this context and point towards the serious diminution in public confidence that could result from a failure or irregularity in an electronic voting system, particularly if the system was new. In this scenario public confidence, both in the voting system and the electoral authority, could be destabilised well into the future, and would be very difficult to regain.47 The issue of the potential impact of electronic voting is also relative to the amount of trust in the electoral system, and the resultant scepticism that the voting public may have.
4.79 Even technology commentators recognise the detrimental impact that electronic voting may have on public confidence in the electoral system:
Democratic legitimacy doesn't just require that votes be counted fairly and accurately, it also requires that they be widely accepted as being fair and accurate. To achieve that level of legitimacy, it's important that every voter be able to understand how the voting process works, so they can have confidence that it will work correctly.
The transparency of paper ballots is a huge advantage here. Everyone understands how paper works, and paper ballots can always be counted by hand if people suspect that counting machines have malfunctioned.
Of course, paper elections can be stolen too. But the techniques for stealing elections are more visible and labor-intensive. Generally, to steal a paper election you need to recruit co-conspirators to visit various polling places and modify or replace hundreds of thousands of ballots. For a large election, that requires a sizable operation that's likely to be detected.
In contrast, an electronic election allows someone to steal votes silently and invisibly by tampering with a voting machine before the election begins. A single hacker or corrupt insider might have an opportunity to tamper with dozens of machines — especially because some voting machines have been shown to be vulnerable to voting machine viruses that spread from one voting machine to another without any direct human action.48