Security Analysis of the Estonian Internet Voting System

Abstract

Estonia was the first country in the world to use Internet voting nationally, and today more than 30% of its ballots are cast online. In this paper, we analyze the security of the Estonian I-voting system based on a combination of in-person election observation, code review, and adversarial testing. Adopting a threat model that considers the advanced threats faced by a national election system -including dishonest insiders and state-sponsored attacks -we find that the I-voting system has serious architectural limitations and procedural gaps that potentially jeopardize the integrity of elections. In experimental attacks on a reproduction of the system, we demonstrate how such attackers could target the election servers or voters' clients to alter election results or undermine the legitimacy of the system. Our findings illustrate the practical obstacles to Internet voting in the modern world, and they carry lessons for Estonia, for other countries considering adopting such systems, and for the security research community.

An Assessment of the Security and Transparency Procedural Components of the Estonian Internet Voting System

“…A good example of the issue regarding the presence of additional devices in secure areas has already been witnessed in prior elections (e.g., see [3]). In that case, system glitches reportedly prevented the use of DVDs to transfer voting data (votes for tallying) to the VCA, and as a fall-back, officials used a removable device.…”

“…While some observers hail Estonia's success in Internet voting, their I-Voting system has also come under close scrutiny [2,3,4]. Security concerns have drawn on in-person election observations, code reviews, adversarial testing on system components, and topics such as the impact of infected voter computers and the lack of end-to-end verification.…”

“…Security concerns have drawn on in-person election observations, code reviews, adversarial testing on system components, and topics such as the impact of infected voter computers and the lack of end-to-end verification. Some articles have sought to demonstrate these potential problems using simulated examples of attack payloads and patterns to compromise the electoral process [3]. Others point to the fact that integrity should be supported by technological means rather than a complex set of manual checks and procedures [4].…”

“…The only question that we would raise here is with regards to the extent to which these reports are publicly available and comprehensible to lay readers; the more accessible and easier to understand, the better. Although some reports suggest that they are accessible [3], others speak to the contrary [2].…”

“…However, as highlighted by other articles [3], better care must be taken to ensure security despite the pursuit of transparency. A perfect example of this issue is inadvertently exposing sensitive information (e.g., passwords) in published videos, or observers being able to take photos or film passwords themselves.…”