An Assessment of the Security and Transparency Procedural Components of the Estonian Internet Voting System

Abstract

Abstract. The I-Voting system designed and implemented in Estonia is one of the first nationwide Internet voting systems. Since its creation, it has been met with praise but also with close scrutiny. Concerns regarding security breaches have focused on in-person election observations, code reviews and adversarial testing on system components. These concerns have led many to conclude that there are various ways in which insider threats and sophisticated external attacks may compromise the integrity of the system and thus the voting process. In this paper, we examine the procedural components of the I-Voting system, with an emphasis on the controls related to procedural security mechanisms, and on systemtransparency measures. Through an approach grounded in primary and secondary data sources, including interviews with key Estonian election personnel, we conduct an initial investigation into the extent to which the present controls mitigate the real security risks faced by the system. The experience and insight we present in this paper will be useful both in the context of the I-Voting system, and potentially more broadly in other voting systems.

Untitled

“…Parliamentary elections, and four nationwide local elections between 2005 and 2019 (Ehin et al 2022). Also, the country's voting system has been robustly studied and analysed, examining themes such as efficiency, transparency, security, and auditability (Nurse et al 2017;Heiberg et al 2011, September). A major step in qualitative case studies is the determination of a case, and this study adopted Estonia as the case, and compared the findings on technology deployment in elections in Estonia with those from Nigeria.…”

“…Despite its high praise, the Estonian e-voting system has not been without criticism. Concerns about breaches have led to greater scrutiny through observations, code reviews, and adversarial testing of the voting system components (Nurse et al 2017). Some criticise the security of the system, arguing that this should depend on the technical measures implemented rather than on the hope that officials will act professionally.…”

“…Estonia is a relatively small country and replicating the Estonian electronic voting model might prove daunting for large nations. Nurse et al (2017) noted that the various concerns raised suggest DOI: 10.20940/JAE/2023/v22i2a4 vulnerabilities that malicious insiders and sophisticated external attackers may capitalise on to compromise the voting system.…”

“…Estonia's internet voting system does not have a full public server-side function. However, Ehin et al (2022) and Nurse et al (2017) noted that Estonia employed designated auditors to verify the process's integrity, much like traditional elections. Also, the system's mixer and decryption server components use cryptographic proofs that can be relied on for independent verification.…”

Technology, cyber security and the 2023 elections in Nigeria: Prospects, challenges and opportunities

“…Estonians have used the electronic voting system in four national elections, three European Parliamentary elections, and four nationwide local elections between 2005 and 2019 (Ehin et al 2022). Also, the country's voting system has been robustly studied and analysed, examining themes such as efficiency, transparency, security, and auditability (Nurse et al 2017;Heiberg et al 2011, September).…”