January 2017

Note to the Reader



This report was prepared by Nicole Goodman, Director of the Centre for e-Democracy, for the Privy Council Office. The Centre is a charitable organization that generates, translates and disseminates scholarly knowledge about the ways digital technology is affecting politics and society. Special thanks to Adam Froman, Chelsea Gabel, Jon Pammett, Karen Bird, Les Jacobs, Uwe Serdült, Leah Stokes, Thad Hall, John Jack, Joyce King, Valerie Monague, Dwayne Nashkawa, Susan O’Neill, Stéphanie Plante, Chief Shining Turtle, Priit Vinkel, Dan Wallach, and Ramage Zaki for their participation in, and support of, an Online Voting Roundtable that informed the report. Sincere appreciation is extended to Aleksander Essex and Jeremy Clark as participants in the roundtable and for their assistance as technical advisors on this subject matter. Thank you also to those who contributed their knowledge and participated in interviews for this report: Keith Archer, Jordi Barrat, Jeremy Clark, Ardita Driza-Maurer, Eric Dubuis, Aleksander Essex, Thomas Hofer Joyce King, Jean-Pierre Kingsley, Reto Koenig, Robert Krimmer, Brian Lack, Olivier Léclere, Leontine Loeber, Jacques Mailloux, Tarvi Martens, Steven Martin, Marc Mayrand, Gary McLeod, Lyne Morin, Dwayne Nashkawa, Stéphane Perrault, John Poulos, Carsten Schürmann, Dean Smith, Oliver Spycher, Vanessa Teague, Priit Vinkel, Melanie Volkamer and Gregor Wenda. Finally, thank you to participants in the October 2016 EVOTE-ID meeting in Bregenz, Austria for their knowledge and ideas regarding online voting, and to Peter DeMaio for research assistance. The Social Sciences and Humanities Research Council of Canada sponsored some of the research that informs this report. The opinions, errors and omissions in this report are those of the author.

Executive Summary



Despite some technical advances in elections, notably an electronic National Register of Electors, the act of voting at the federal level in Canada is largely carried out on paper. Activities such as voter strike-off at the polls, changes to poll books, the administration of oaths, the casting of ballots and ballot tabulation are done manually. The increasing adoption of digital technology in society and other areas of government to improve efficiency, transparency and accountability raise questions as to whether technology can deliver the same benefits for federal elections in Canada. Of possible technological changes to the election process, online voting is typically identified as the reform that promises to deliver the greatest benefits, while also posing the greatest risks. Drawing on the latest research, interviews with Canadian and international experts, and case studies of online voting developments in Estonia, Switzerland and the United States, this report examines the feasibility of online voting for use in federal elections in Canada.

Recent increases in advance voting in Canada, a rise in non-voting rationales that can be addressed with additional accessibility measures, and growing public interest in using online voting suggest the voting reform would be favourable for many Canadian electors. Benefits of online voting adoption relate to voter convenience and improved accessibility, enhanced voter privacy, modest increases in voter turnout, reduction in ballot errors and spoiled ballots and possible improvements to the efficiency of elections. Barriers include limitations of digital literacy and access, ballot secrecy, overcoming authentication and verification, auditability, possibilities for fraud and coercion, security threats, identifying clear requirements for online voting implementation, voters’ list accuracy, outreach and education, possible privatization of elections and loss of the voting experience. Review of the technology emphasizes the importance of contextually appropriate authentication credentials that meet security standards, as well as the necessity for end-to-end verification in voting systems. Regarding emerging technologies, while blockchains can support some issues with online voting such as protecting the uniqueness of the vote and enabling verifiability with a transparent and irreversible transaction record, there remain many technical issues blockchains cannot solve and at this time they are not the silver bullet to delivering issue-free online voting. Case studies of Estonia, Switzerland and the United States highlight the importance of slow testing, implementation, research and active collaboration with outside experts, public willingness to vote online, adoption of online voting as a complementary channel and not a replacement to paper voting, the need to continually update technology and legislation, the importance of standards especially related to security, and that the adoption of the voting reform depends largely on the culture and institutions of the jurisdiction. In Canada specifically, evidence at the municipal level finds that online voters are satisfied with the voting method and a majority of paper ballot voters would like to have it offered as a complementary voting channel. Although a wide range of electors uses it, the primary users of online voting are typically older, educated and wealthier. From an administrative perspective convenience, accessibility and counting efficiency are cited as the main benefits to online voting adoption, while public outreach and education, negative media and potential for fraud are reported as the biggest challenges. The report concludes with policy recommendations regarding online voting use in federal elections for the short and longer-terms. The overarching recommendation of the report is that Elections Canada should actively research and test online voting in federal elections on a trial basis, and lay the groundwork for possible future development.



The eleven recommendations in the short-term are:

Define the objectives of introducing online voting and the goals of a pilot or trial. Based upon a review of the findings in 1 above, have Elections Canada proceed with a binding trial of remote online voting.

Seek parliamentary approval to proceed with trials.

Elections Canada should consider the establishment of an expert advisory group to ensure that the necessary technical, legal and policy expertise is on hand to support online voting efforts.

Work with a technology vendor for initial pilots.

Increase the technical knowledge of Elections Canada by engaging with experts and developing an in-house technical unit.

Engage stakeholders as part of the adoption process.

Education of electors and candidates.

Establish a security framework that includes end-to-end verifiability, regular security audits carried out by independent experts, and appropriate authentication measures.

Develop an evaluation framework for online voting prior to a trial.

Consider other changes to improve voter access and convenience.

In the longer-term, the following four recommendations are suggested: In consultation with experts, develop a national framework for online voting which include standards that could be voluntarily followed by lower levels of government. Continuous technical updating is necessary.

Foster a security-conscious culture.

Develop a legislative framework for federal elections.

Introduction



One of the most dramatic changes to our way of life over the past 50 years has been the widespread proliferation and use of digital technology. Through different mediums technology is increasingly embedded as part of our lives, modernizing our institutions, culture and way of life. A large part of this technological shift includes advancements and opportunities brought about by the internet. Today many people buy their groceries, pursue relationships through dating sites, conduct their banking, watch movies or shows, work remotely, and communicate using forums or applications that rely on the internet. The internet is also transforming governments and the way we interact with them, creating additional participation channels and in some cases enabling the culture of government to become more open, transparent and accountable. While technology has influenced government in other areas, efforts to modernize or digitize electoral institutions at the federal level have been slow. Aside from some smaller changes and the 1997 introduction of an electronic National Register of Electors, elections remain largely a manual process that are carried out on paper. Tasks such as voter strike-off at the polls, changes to poll books, the administration of oaths, the casting of ballots and ballot tabulation are done manually. If the internet can be used to promote transparency and accountability in other government institutions, can the same be true for federal elections? There are many ways to modernize elections and to integrate technology into phases of the election process, however, online voting is commonly cited as the voting reform that delivers the greatest potential benefits for election stakeholders and also carries the greatest risk. Determining whether it is an appropriate policy change is challenging, as the same arguments for and against adoption of the technology are continuously repeated in policy debates. Use of the voting method by other jurisdictions has led to the discovery of new effects and challenges, which confirm or refute some of these arguments. Similarly, deployment of online voting in municipal elections in Canada provides insight regarding the types of impacts the voting method may have federally. This report examines the feasibility of online voting for use in federal elections in Canada. Six sections are included. The first section outlines the methodology, defines online voting, and provides justification for the country cases included in the report. The second portion focuses on whether there is a public culture of support for online voting by providing an overview of recent trends in voter behaviour, reasons provided for not voting in federal elections, and Canadians’ appetite for online voting. Third, the real and perceived benefits and barriers of online voting are briefly discussed. Potential strategies to mitigate barriers are included. The fourth section examines the concepts of authentication and verification in more detail and discusses the possibility of blockchain technology to improve online voting systems. Fifth, an overview of practical experiences is provided. This begins with a brief review of online voting in Canada and follows with case summaries of online voting approaches in Estonia, Switzerland and the United States. Finally, the report concludes with a series of concrete policy recommendations regarding the potential deployment of online voting in federal elections.

1. Methodology, case justification and definitions



Methodology



The content of this report is based on a review of secondary sources and primary research. Sources include government documents, scholarly books and articles, technical reports, news articles and survey data. Primary research was carried out by way of semi-structured interviews and consultations with 32 officials (16 in Canada and 16 internationally) who have expertise in voting technologies. Those consulted include a diverse group of scholars, practitioners, lawyers, and government officials. Experts were interviewed in person, by phone or video conference and were asked questions about the legal, operational and technical considerations of online voting, how to mitigate or overcome barriers, thoughts about online voting at the federal level and recommendations, and about the future of elections in Canada more generally. A majority of the interviews were guided by a questionnaire (see Appendix 1), however the specific questions that were focused on varied based on the background and expertise of the interviewee. Questions about mitigating security risks, for example, were better suited for computer scientists, engineers and practitioners, while government officials, practitioners and social scientists mostly addressed those about the administration of elections. In some cases, a full and formal interview was not possible and particular questions were asked based on the competencies of the interviewee and timing. In the case of Elections Canada, a separate consultation was held using an alternate questionnaire which is attached as Appendix 2. All participants were informed of the nature of the research prior to speaking. In addition to the interviews, information in the report comes from presentations, papers and discussions from the EVOTE-ID meeting held from October 18 to 21, 2016 in Bregenz, Austria, and an Online Voting Roundtable organized by the Centre for

e-Democracy in partnership with a First Nations Digital Democracy project funded by the Social Sciences and Humanities Research Council of Canada, McMaster University and the Centre for International Policy Studies at the University of Ottawa. The EVOTE-ID conference brings together experts, practitioners and government officials from around the world to discuss electronic voting. It is an interdisciplinary event, including contributions from those with social science and computer science backgrounds. The conference also includes scholarly and practical tracks, presenting findings of the latest academic studies and updates on practical electronic voting developments worldwide. The meeting included a discussion and update of the Council of Europe recommendations on electronic voting (2017), which can be leveraged by Canadian authorities to learn from and build upon. The Online Voting Roundtable was held September 26, 2016 at the University of Ottawa with the goal of contributing to the dialogue on electoral reform in Canada. It included presentations from technical experts, social scientists, Indigenous leaders and community members, and representatives from other countries to discuss the possibility of using online voting in federal elections in Canada. This event brought an Indigenous perspective to debates about online voting, which had previously not been highlighted. These events provided a rich and timely perspective on the latest online voting developments and the effects of using the technology. They also highlighted which country cases are best for Canada to learn from.



Case justification



Other than online voting activity at the local level in Canada, use of the voting method in Switzerland and Estonia is the most established. Meaning, it has occurred there for the greatest number of binding elections, is used for votes at multiple levels of government, and is considered by politicians and citizens alike to be an established feature of election processes. Furthermore, developments in these countries have made progress on technical considerations such as verifiability, developing solutions to meet this technical challenge. Finally, online voting developments in these cases have been in place since 2003 and 2005 respectively, providing a picture of the evolution of online voting approaches and systems, how they have responded to specific challenges, and effects or benefits that have been realized.

A third case that has followed a different development path but is of interest to voting modernization in Canada is the United States (US). Early online voting activity in the US included a January 2000 state-wide straw poll of Republicans in Alaska, the March 2000 Arizona Democratic primary, an experimental project carried out as part of the Federal Voting Assistance Program (FVAP) as part of the 2000 presidential election, and the 2004 Michigan Democratic primary. Concerns about security and the technical risks raised by major voting reports in the US, however, slowed, or in some cases halted, developments.1 Although technical barriers are echoed today election modernization has begun moving forward in the US, and various types of online voting or electronic ballots are used for military overseas and citizens abroad in 32 states, and in state and federal elections in Alaska. The fact that the US has moved forward despite these identified barriers is an opportunity for Canada to learn about how these perceived challenges are being mitigated and derive any lessons learned that could be applied to federal elections here.

Defining online voting



Generally, online voting refers to the process of casting a ballot via an internet connection. It is commonly associated as being one type of electronic voting - a general term used to refer to many different types of voting that use information and communications technology in part or all of the voting process, which includes identifying the voter, the casting of the vote, and the counting of the vote. In their 2011 Handbook on electronic voting the International Institute for Democracy and Electoral Assistance (IDEA) defines electronic voting as “systems where the recording, casting or counting of votes in political elections and referendums involves information and communication technologies” (2011:6). A definition of internet voting provided by the US Public Policy Council of the Association of Computing Machinery (2010) explains that it is “returning an electronic form or voted ballot over the internet using email, a web application or an internet-based fax or phone (e.g. the iPhone).” The difference between these two definitions is the presence of an internet connection, characterized by the transmission of a ballot and other aspects of the voting process that take place online. For the purposes of this report internet voting is defined as systems where obtaining ballots, casting votes or counting votes in political elections and referendums uses an internet connection. There are different types of online voting that can be distinguished by whether they occur in a supervised (controlled) or unsupervised (uncontrolled) environment. Alvarez and Hall (2003) point to four types of internet voting. Two of these, precinct internet voting and polling place internet voting involve voting online at a polling station, the former occurs at an individual’s designated polling location whereas the later takes places at any polling place. These options offer more control for election officials and less accessibility and convenience for potential voters. Next, there is kiosk internet voting which denotes voting by internet from a computer at a location that is controlled by election officials, but is not an official polling place. Kiosks are typically located in public places that are considered high-traffic areas such as a mall, library, or local government office. Finally, remote internet voting is the term most people associate with voting online. This method involves casting a ballot via the internet from a remote location, such as home, work or perhaps overseas. Remote online voting could occur on a number of devices such as a desktop computer, laptop, tablet or iPad, or mobile phone connected to the internet. This final online voting option offers election administrators the least control but provides the greatest potential accessibility and convenience for electors.

The primary focus of this report is on remote online voting since it offers the greatest potential to reduce the perceived “costs” of voting2 for electors and is commonly associated with the general term “online voting”. When people think of being able to vote online, they do not envision having to attend a traditional polling station and learn how to navigate new voting technology, but rather assume they will be able to vote from a remote location of their choosing using a personal device. For stylistic relief the report refers to online voting, internet voting and ivoting as one in the same. Unless otherwise noted, these terms refer to remote online voting. However, it should be pointed out that remote online voting from home or work would have to be offered in combination with online voting from central locations such as libraries or community government offices to ensure access and assistance with technical aspects. This latter approach could be considered a type of kiosk voting.

2. Public attitudes in Canada and benefits and barriers



Changes in voting and public attitudes toward online voting



Canadians’ attitudes and opinions about online voting is an important consideration regarding whether the technology should be used, or trialed in Canada. Public support for, and willingness to make use of, the voting reform is necessary. This section reviews changes in voting patterns, reasons for not voting provided by those who have abstained from voting in federal elections, and public attitudes toward online voting and election reform. One of the most compelling reasons for the modernization of voting processes is the change in voting patterns observed over the past 20+ years in federal and provincial elections in Canada. While levels of overall voter participation have observed a general trend of decline, voter turnout in the advanced polls of those same elections have noted substantial increases. More Canadians are choosing to cast their vote in advance of Election Day and there is an increasing service expectation of advance voting that did not exist 30 years ago. In the 42nd General Election, for example, 20.8% of voters cast ballots at advanced polls with a further 3.5% using special voting procedures such as voting by mail. To put this in perspective, turnout in advance polls was 14.2% in 2011, 10.9% in 2008 and 6% in 2000, Figure 1. The same pattern is mirrored in provincial elections in Canada over the same time period and in other advanced democracies. The 2016 Australian federal election, for example, had 24% of votes cast in advance polls with a further 10% cast by mail, for a total of 34% of votes cast before Election Day.

Figure 1: Advance voter turnout in federal elections in Canada, 1991-2015



Text version 1993 1997 2000 2004 2006 2008 2011 2015 5% 5% 6% 9% 11% 11% 14% 21%

Response to this demand has resulted in more advance poll days, the addition of advance poll locations, and lowering or eliminating requirements to cast a ballot before Election Day. In New Brunswick, for example, electors can vote at any polling station in the province during the two advanced voting days. The requirement to complete a form to vote in advance was eliminated in New Brunswick in 2006, while in Saskatchewan the 2016 election was the first where electors were not required to show a medical note or other proof to be able to cast their ballot in an advance poll. Many provincial election agencies have plans to expand changes to advance voting, adopt ‘vote anywhere’ models and add technology to the election process, including real-time strike-off of voters’ lists, online voter registration or electronic ballot tabulation. While these changes may improve poll efficiency and reduce wait times, none of these modifications would have the same impact on voters as the option to vote remotely by internet, which arguably offers the ultimate voting convenience and reduction of voting costs by eliminating the need to travel to a polling station (Alvarez et al., 2009). Steady increases in advance voter participation overtime could be a sign that Canadian voters want greater choice and convenience in the voting process. Evidence from non-voters supports this line of thinking. Survey data from federal elections shows that non-voters are more likely to cite reasons considered to be ‘everyday life issues’ as their rationale for not participating over those that are political in nature and highlight apathy towards the political process or the actors involved in it. Data from Statistics Canada’s 2015 Labour Force Survey, for example, shows that in 2015, 47.9% of non-voters said they abstained for reasons related to ‘everyday life or health’, which includes rationales such as being ‘too busy’, ‘out of town’ or ‘illness or disability’. A further 39.5% reported not voting for political reasons such as not being interested in politics, not having enough information, or not liking the candidates. Finally, 12.6% did not vote for reasons related to the election process like being on the voters’ list, issues with Voter Information Cards, identification, length of lines at the polls, or other reasons. Elections Canada collected similar data from 2000 to 2011 as part of the agency’s Survey of Electors. Grouping these responses into comparable categories shows that reasons falling into the category of ‘political issues’ were dominant in 2000 and 2004, however, in 2008 and 2011 ‘everyday life issues’ emerged as the largest group. This suggests that while apathy and lack of interest is still very much a factor in non-participation, situations of everyday life and health are the most frequently reported barriers electors face in attending the polls. Although the categories are slightly different in Statistics Canada’s 2015 survey, Figure 2 compares these groups. While election officials cannot directly address political reasons (e.g., not liking candidates or being disinterested in politics), changes to election rules and procedures can have an effect on administrative issues such as not being on the voters’ list. Similarly, reducing the perceived costs of voting by making direct improvements to voter accessibility and convenience can work to counter rationales such as being ‘too busy’, traveling out of town, illness or disability, transportation problems and in situations of inclement weather. If voting reforms can sufficiently address these barriers, presumably some of these electors could be motivated to participate. Remote online voting is one possibility to make voting easier and more efficient for electors, but how do Canadian electors feel about the voting reform? Is there public support for the policy change and a willingness to use it? A poll of 1,000 Canadians carried out by AskingCanadians in September 2016 finds that 75% of respondents say they would be likely to vote online if the voting method were available. Persons that reported not voting in the 2015 federal election were slightly more likely to say they would vote online. Regarding the 2019 federal election, 52% of respondents felt that online voting should be available in the advance voting period and on Election Day, 21% said it should be used during advance voting, and 28% felt that electors should not be able to vote online in the next election. To put feelings about online voting in perspective with other possible changes to the voting process, respondents were asked whether they prefer online voting or other proposed electoral reforms such as a new electoral system or mandatory voting. Forty-two percent chose online voting, 24.9% selected a new electoral system, 19.9% said mandatory voting, and 12.9% none of them.

Figure 2: Reasons given for not voting in federal elections, 2000-2015



Text version Reasons for not voting 2000 2004 2008 2011 2015 Everyday life issues 43% 38% 57% 60% 48% Political issues 44% 45% 36% 30% 40% Administrative issues 13% 7% 8% 6% 13%

Data collected by EKOS Research in November 2016 confirms that Canadians would be likely make use of online voting. Seventy-seven percent say they are very (57%) or somewhat likely (20%) to vote online in the next federal election, with 8% being ‘not very likely’ and 20% ‘not likely at all’. This is up from a December 2009 EKOS poll where 64% of those surveyed said they would be likely to vote online, 27% not likely and 9% were unsure, suggesting support for the voting method has increased. This opinion data illustrates that Canadians would like to see online voting introduced and a majority say they would use it in the next election.3

What about voters that opt for paper ballots when online voting is available? How do they feel about online voting? A 2014 study carried out with Ontario municipalities asked paper voters whether they would vote online in a future election. Eighty-nine percent of those surveyed knew that online voting was available but opted not to use it, yet 77% said they would use it in the future. Forty-seven percent of this group said they would opt for an online ballot under ‘special circumstances’, which might involve inclement weather, traveling, illness or mobility issues. The other 30% said they would use online voting ‘no matter what’, while 16% reported they would not use it at all (Goodman and Pyman, 2016). Such strong preference among paper voters for the adoption of online voting as a complementary voting channel shows that they would appreciate and make use of an alternative voting channel in cases where casting a ballot may not be as convenient or accessible.

While there is not comparable data from non-voters, generally Canadian studies of internet voters find that a certain percentage identify as having been a non-voter in previous elections where they were eligible to participate. This group is typically modest. In the 2014 study of Ontario municipalities, for example, 11% of online voters from 43 communities voted by internet reported having not participated before. The first deployment of online voting in the City of Markham’s municipal election had 25% of non-voters cast a ballot online (Goodman, 2014). All of this tells us that Canadian electors are generally receptive to the voting reform. At the same time, there is increasing demand from voters for more choice and convenience in voting, and some of those who abstain cite reasons for not participating that could be addressed by changes to voting access and administrative procedures. Changes in uptake of convenience voting (e.g. voting in advance polls), shifts in reasons for abstention, and growth in the number of electors likely to make use of online voting foster a public culture of support for the policy change. While online voting is not the only policy change that could address some of these issues and elections can be modernized in other ways, remote online voting offers many benefits to electors in terms of reducing voting costs, and enhancing access and convenience. There are, however, important barriers to adoption.

3. Benefits and barriers to online voting adoption



Benefits



This section provides a brief overview of the primary benefits of, and barriers to, online voting implementation. It assesses whether the latest research confirms these considerations as advantages or drawbacks. It is important to note, however, that the implementation of online voting is highly context dependent and what delivers benefits in one jurisdiction may present challenges in another. There are many real, and perceived, benefits and barriers to online voting deployment that often relate to election administration, technology or social issues (Goodman, Pammett and DeBardeleben, 2010). These can be broadly categorized into benefits for two groups – voters and election administrators. Although there are benefits and challenges for candidates also, debates typically focus on items that affect those voting or administering the election. First, proponents cite convenience and the principle of voting at any time as a primary advantage. Research of online voters in municipal elections in Canada confirms that convenience is the leading reason for using the voting method, with 66% of those surveyed in the 2014 Ontario municipal elections noting that is why they voted online (Goodman and Pyman, 2016). Research in other countries confirms the prominence of the rationale, as 85.8% of online voters in Estonia reported choosing the method because of convenience (Alvarez, Hall and Trechsel, 2009). Being able to cast a ballot from anywhere, at any time, and eliminating the need to travel to a poll location during specified hours, is the epitome of convenience voting. Being able to vote in the middle of the night from home, while traditional polls were closed, might be the added convenience for some non-voters to take part at election time, and a welcome change in a society where people increasingly feel they are busy and cannot take time out of their day to vote or forget to plan for it. Forms of online voting that are not remote can add convenience, but not to the same extent. In addition to enhancing the convenience of voting, voting by internet also has the potential to improve voter access. While accessibility can be augmented for all, those who face the most barriers to participation would feel the greatest effects. Special groups of electors such as persons with disabilities, citizens living overseas or military abroad, members of Indigenous communities, persons living in remote areas, incarcerated electors, seniors with mobility issues or those living in long-term care facilities, and students away at school can face additional barriers to voting which could be reduced with the option to vote online. In particular, for persons with disabilities who require assistance voting, special applicators can be used to allow these voters to cast a ballot independently providing greater privacy and improved equality of the voting process (Goodman, Pammett and DeBardeleben, 2010). Likewise, mail ballots cast by voters overseas may not arrive or be counted until after the results of the election. Studies of online voting and overseas voters find the voting reform has been well received by expatriates in places such as Switzerland (Germann et al., 2015). In Canada, interviews for this report indicated that online voting could bring about significant improvements to access for members of Indigenous communities living on-reserve, providing suitable internet connectivity was in place. Third, the premise of making voting easier causes some to suggest it can increase, or at the very least, counter declines in voter turnout observed in Canada and other advanced democracies (Franklin, 1999). Evidence on whether online voting affects turnout is mixed, with some academic studies finding no effect, and others small increases of less than 3% (Gerlach and Gasser, 2009; Trechsel and Vassil, 2010; Vassil and Weber, 2011), or larger changes of up to 10% (Solop, 2001; Spada et al., 2016). At the municipal level in Canada researchers examining online voting adoption overtime find that internet voting increases voter turnout by 3%, which is consistent with increases from other methods of ‘convenience voting’ such as voting by mail (Goodman and Stokes, 2016, Gronke et al., 2008). This shows that in a Canadian context the voting reform can positively affect turnout. Changes to election rules at the municipal level, however, are often felt more strongly than at higher levels of government (Kousser and Mullin, 2007) so we should be cautious about whether such an effect would materialize in federal elections.

It is noteworthy that some non-voters (people who were eligible but have never voted) and infrequent voters (people who vote ‘some of the time’) are drawn to internet voting in Canada (Goodman, 2014) and European countries such as Estonia (Madise and Martens, 2006, Breuer and Trechsel, 2006, Trechsel and Vassil, 2010) and Switzerland (Chevallier, 2009, Trechsel, 2007). This means that some electors who have not voted previously voted for the first time, or on a more regular basis (in the case of infrequent voters), because online voting was an option4. Despite the fact that internet voting is predominately used for reasons of convenience by committed voters, this evidence shows that it also encourages some electors to participate and may help retain current voters.

Finally, claims of youth engagement are often made since presumably young people are more technically inclined than previous cohorts of electors and are avid users of the internet. Studies find, however, that young or first time voters are more likely to vote by paper than online (Baldersheim, Saglie and Segaard, 2013; Goodman and Pyman, 2016) perhaps out of symbolism for their first time participating. Online voters are typically older, educated, wealthier, and report voting in the past (Goodman and Pyman, 2016). Research from Switzerland that examines Geneva’s vote registry data shows that older voters are likely to remain committed to online voting after the first use, whereas many young voters shift back to paper voting or abstention (Serdült and Mendez, 2016). Tracking voting histories and age at the municipal level in Canada finds that some young people are motivated to vote when online ballots are offered, however this group is modest. In fact, in the 2014 municipal elections in Ontario paper ballot use was higher among those under the age of 44 while those over 45 years were more likely to vote online. Overall, while online voting can encourage some younger electors to vote, research shows that they tend to prefer to vote by paper and that online voting is not a solution to counter low youth voter turnout. Overall, improved voter engagement can be a benefit of remote online voting, but there should be an expectation that any hoped for increases would be modest.



Administratively, online voting can reduce ballot errors and spoiled ballots, which can occur by selecting too many or too few candidates, unclear markings, or markings that identify the voter by letting the voter know if s/he has over-voted or under-voted (Elections BC, 2014). The proportion of rejected paper ballots is typically about .05% of all votes cast. Furthermore, interviews revealed that on average about 3-4% of ballots tallied manually are counted incorrectly. This can occur as poll workers work long hours with the counting happening at the end of what might be a 12-hour day, and because of subjective interpretations of markings on the ballot. Although these amounts are small, the franchise could be improved by the inclusion of these votes. Additionally, online voting systems can include an option that allows electors to spoil their vote. In some countries, such as France, the option to spoil your ballot is enshrined in the constitution.

With regards to election costs, there is no certainty that online voting will inevitably bring the cost of elections up or down. Cost is dependent on the approach employed by election authorities and influenced by factors such as the number of voting methods offered, length of the voting period, and the process that facilitates voting online (e.g., mail outs to electors beforehand). Whether the system is developed in-house or supplied by a technology vendor could also significantly impact the upfront cost of online voting adoption.5 According to experts direct comparison between the cost of paper ballots per elector and online ballots shows a cost savings overtime. Vendors estimate that at the federal level in Canada the cost of online ballots would be about $1 per elector plus the cost of mail-outs. Generally where paper and online voting are offered alongside one another the cost per elector is about 70-75% less for internet ballots.6

Municipal (e.g., Cape Breton Regional Municipality) and provincial (e.g., Elections PEI) officials in Canada that have used a combination of voting methods simultaneously have been able to offer paper and internet ballots without a substantially increased cost by reducing the number of polling tables, or locations. These changes to the quantity of paper voting locations does not typically affect voter access to polling locations or wait times since when online voting is offered as a complementary voting method in municipal elections in Canada is the preferred ballot type (Goodman and Pyman, 2016). Other often cited benefits relating to election administration include expedited ballot tabulation and improvements to efficiency and accountability. With regards to ballot tabulation, proponents argue that online voting offers immediacy of results. In the case of Cape Breton Regional Municipality in 2012, for example, the process to tabulate the ballots and issue a report took about 30 minutes. In other municipal elections, however, technical issues have delayed results. In the case of the 2014 election in the Municipality of Leamington, for example, a computer glitch delayed results for about 3 hours. This delay was cited as necessary to ensure the quality assurance of election results. While there can be tabulation efficiencies realized from online voting and other electronic counting devices, they are not guaranteed. In places with voting systems where ballot tabulation is more intricate, or the composition of the ballot papers are much more complex, online voting presents added appeal. This is not as much of an issue in Canada given our single member plurality system and relatively simple ballots. Other improvements online voting systems can deliver are real-time strike off to the voters’ lists, although other technologies such as electronic poll books can also provide this. In cases where a thorough election evaluation or auditing procedure was not in place previously, the advent of online voting often can strengthen this process by prompting election authorities to rethink these processes, thus enhancing accountability.

Finally, reduced environmental impact is expressed as a benefit since fewer paper ballots are required and taking into account emissions saved from not traveling to a poll location.7 Keeping up with other societal change is also mentioned. While elections have been slow to modernize, banking online and other transaction-based activities cannot be compared to online voting given that a key premise of their operation is the acceptance of risk (Wallach, 2016). To maintain the integrity of elections, the same approaches to managing risk are not applicable. We should also expect modernization to be relatively slow, and deploy online voting as a complementary voting channel and not as a replacement of paper ballots.

Overall benefits such as convenience, access, greater voter privacy and reduction in spoiled ballots are well established. Modest improvements in turnout are also documented in a Canadian context, albeit for municipal elections, as well as the attraction of some non-voters to the voting method. While young people vote online, many prefer to vote by paper and it does not hold the benefits for youth engagement that were once thought. Finally, items such as cost reductions and efficiencies in election results, notably near instant tabulation, are context dependent and not always guaranteed.



Barriers



Opposition to online voting, or hesitancy to pursue it, is based on several principal barriers. Discussions about barriers have evolved as we have learned from trials and use in regular binding elections. Through this process some previously identified barriers have been discovered to not be significant obstacles and other new barriers have emerged. Those items presently identified as being barriers to online voting adoption are explored here with possible solutions or strategies of mitigation incorporated into the discussion. First, a popularly mentioned social barrier to online voting is digital literacy and the potential limits a digital divide may impose on electors and their ability to vote online. Digital literacy refers to technical competencies and information literacy with computers or other digital devices and the internet (Mossenburg, Tolbert, and Stansbury, 2003). When online voting is first introduced research confirms there is a relationship between digital literacy and online voting. This means that those which have more experience with, and confidence in using, the technology are more likely to vote online, albeit, as other studies have shown, not necessarily youth (Bélanger and Carter, 2010; Madise and Martens, 2006, Sciarini et al., 2013; Serdült et al., 2015). The digital divide refers to having access to an internet connection, the quality of that connection and digital skills and knowledge (van Deursen and van Dijk, 2011). If an elector does not have access to the internet, or a poor quality/ slow connection, it is argued they will be less likely to vote online. Likewise, the argument goes that those with experience using the internet would be more inclined to vote online. Persons with higher incomes and education levels are more likely to have personal computers or devices with good quality internet connections, and the technical skills and knowledge to use them. Furthermore, the ability to access good quality internet may be easier in urban areas than rural ones. These socioeconomic factors can create a divide, putting those with lower incomes and/or who reside in rural places at a disadvantage. Instead of promoting equality of the vote, the digital divide can exacerbate pre-existing socioeconomic cleavages in society and have negative impacts on inclusiveness and representation. Though this is less of a concern that it was ten years ago given improvements in internet penetration and wi-fi coverage, it remains an issue in some more rural places in Canada, notably in northern areas and Indigenous communities. In Canada, municipalities have addressed internet access issues by providing online voting stations in popular public places such as the library, community centre, or local government office. Staff at these locations are trained as Deputy Returning Officers to assist electors with voting. Another concern is that older electors are less inclined to vote online since some of them may have lower levels of digital literacy than young people. It is a myth that older electors will not vote online even with limited experience. Municipally in Canada, the average age of an online voter is 53 years, and those over 50 are the biggest users of the voting method. For comparison, the age of the average paper ballot voter in the same elections is 44 years old (Goodman and Pyman, 2016). Another barrier, which relates to both social and technical issues is ballot secrecy. The Organization for Security and Co-operation in Europe (OSCE) notes that the secrecy of the vote means “it [is] not possible to associate a vote with a specific voter” (2013:9). On the social side, remote online voting can allow for ballot secrecy to be compromised if voters do not cast their ballot in private. This could occur in situations where someone helps another family member vote or has others present for the act of voting. Voting by internet in an unsupervised environment also increases the possibility of fraud or coercion. A term referred to as “family voting” is commonly cited as a concern with remote online voting. This refers to a situation where some families “vote collectively in ways that uphold the clan-style biraderi (‘brotherhood’) relationships that govern a range of their social relationships, including marriages” (Smith, 2013). Additionally, pressure from a head of household can occur in situations where a dominant family member wishes to influence and control the vote. Voter coercion is said to occur more frequently in religious groups (Ibid). Finally, concerns about campaign workers going door-to-door with iPads and possibilities for undue influence, notably for groups that may be more susceptible (e.g., residents of old age homes), has been raised at the municipal level in Canada (e.g., City of Toronto online voting debate). Some jurisdictions have implemented strategies to mitigate the threat of “family voting”, such as Estonia, while others (e.g., Norway and Switzerland) have dismissed the issue as something that is not likely to occur or be a threat to elections. The Estonian solution mitigates the potential for coercion or “family voting” but is not foolproof. Electors can cast as many online votes as they like leading up to Election Day. This allows voters to change their vote if they find themselves in a situation where they feel pressured or coerced to vote for a candidate who is not their true choice. There is no internet voting on Election Day in Estonia, so a final possibility is for a voter to visit a poll location and cast a paper ballot, which will override their online vote. This strategy works well for Estonians, however, overall remote online voting is not strongly coercion resistant. Canadian municipalities have addressed the possibility of fraud by educating electors about the penalties associated with this activity, and in some cases, passing legislation to strengthen penalties to act as a deterrent. No current internet voting approach can guarantee coercion is prevented in an unsupervised setting.

The issue of ballot secrecy continues beyond the voter casting his/her ballot. An additional concern is keeping the votes private before and after the ballot is transmitted. Some computer scientists argue that while there are techniques for protecting privacy at certain points, this is not possible the entire time (Epstein, 2010; Fitzgerald et al., 2016). In the strictest sense no one but the voter should be able to determine his/her vote choice, this includes a technology vendor, hackers, family, IT professionals running the servers, and the government. To keep the votes private proper encryption is required from when the vote is cast until it is decrypted and counted.8 To tackle this the Estonian model relies on a double envelope scheme based on the system popularly used for voting by mail. The anonymous online vote is encrypted (inner envelope) and placed in a second envelope with the voters’ identifying information and digital signature (outer envelope) that confirms they cast a ballot. Before the votes are tallied, the envelopes are separated by a trusted entity, detaching the voters’ personal information and leaving only marked encrypted ballots.9 These ballots are then “moved to a physically separate machine, which decrypts and counts them” (Springall et al., 2014).

Ballot secrecy is one of the top barriers to online voting implementation (Epstein, 2010). In their report on New Voting Technologies the OSCE further stresses that any voting or counting process that does not adhere to the principle of ballot secrecy “cannot be considered democratic” (2013:9). Yet, in some countries online voting works well because other unsupervised voting, such as voting by mail, is widely used and accepted10 If other unsupervised voting methods are customary online voting is more easily accepted.11

Seventh, authentication is another barrier that must be sufficiently overcome to adopt online voting. It refers to the process of confirming voters are who they say they are. It also ensures that those who are voting are eligible to do so and that no one elector can cast more than one ballot (Gritzalis, 2002). The Elections BC report on internet voting explains that “when authentication occurs remotely, traditional identity documents must be replaced with another form of credential that can be used and verified electronically” (2014:28). The process used to authenticate a voters’ identity and credentials vary. In Estonia, Electronic ID cards that contain a digital singing key for performing encrypted digital signatures are used, whereas at the municipal level in Canada some communities rely on a unique PIN code provided on a mailed Voter Information Card and the voter’s birth date. The latter approach is not considered sufficiently secure by many experts given that it is easier to compromise. Requiring registration to vote online, carried out in person or online and with a second mail out that provides the voter with additional credentials is considered to deliver improved authentication. In Canada, the absence of a universal form of electronic identification makes the possible adoption of the Estonian model unlikely. The approach employed in Switzerland is more relevant based on contextual circumstances and existing infrastructure.

Auditability of voting must be maintained with online voting. Those who can audit an online voting system may be different than persons who could assess a paper-based scheme given that technical knowledge may be required. A critical part of system auditability, which can present additional challenges to ballot secrecy, is the verifiability of the vote. The issue of verification has been present in computer science and engineering debates for some time (Gritzalis, 2002) but emerged in practical online voting debates sometime after the first few phases of initial deployments around the world probably because as the number of online voters increased so did the associated risk. The idea behind verifiability is to act as a mechanism to ensure the accuracy of the election outcome (Benaloh et al., 2014; US Vote Foundation, 2015). From the outside an election might appear to have been properly conducted and produced an accurate outcome, but there is the possibility that errors and fraud could go undetected. To mitigate this online voting systems can be made verifiable.

There are two types of verifiability – individual verifiability and universal verifiability. The former is based on a voter being able to ensure their ballot was cast as intended and recorded correctly12 Universal verifiability or end-to-end verification (E2E) is considered to be the gold standard in terms of verifying election outcomes. Like individual verifiability it is based on the principle of confirming that a voter’s ballot was cast as intended and that votes are tallied as cast, meaning that “any member of the public can verify that every recorded vote is correctly included in the tally” (Benaloh et al., 2014: 2). This concept is discussed in greater detail in the technical section, below. Although initially online voting systems did not employ this technology, approaches in Estonia and Switzerland have recently undergone a significant transformation to ensure elections are verifiable given that this principle is seen as pivotal to maintaining electoral integrity and accountability of election outcomes.

Security threats present a significant barrier to online voting use in elections and referendums.13 In general terms, vulnerabilities exist in three main places: the voters’ device, in transit, and at the election server (Elections BC, 2014; Essex, 2016). The voter’s device is often identified as the least secure since it is not controlled by election authorities and given the wide possible array of devices and software voters possess. There are a number of potential strategies to mitigate security threats at this stage. Anti-virus software, for example, can detect and stop malware, but no program can guarantee discovery of all fraudulent software. Using Transport Layer Security (TLS) is also important to ensure a secure connection between an elector’s device and the election website or voting server. TLS refers to the small green padlock in the location bar where the website address/ URL can be found. Without it, there is no secure connection between a device and a website or server. Public education that encourages security conscious thinking is another potential solution to promote awareness and encourage electors to use TLS and employ anti-virus programs.

While a vote is in transit, it is susceptible to third-party attempts to view, intercept or modify data. Strategies such as encryption and digital signatures “can also be used to protect the integrity and authenticity of the data in transit” (Elections BC, 2014: 24). Additionally, verification can alert voters or authorities as to whether votes have been tampered with or compromised.

Finally, at the point of the election server a number of threats can occur such as Denial of Service attacks (DDoS), server penetrations, insider influence or tampering by a state-level actor (see Table 1 for descriptions of these threats). DDoS attacks can be mitigated through dynamic or hidden website addresses, but these can be confusing for voters. Another strategy is to make the voting method available for a longer period of time and not on Election Day. This can spread out use and avoids the high voter traffic on the day of the election (Elections BC, 2014). A number of large Canadian cities such as the City of Markham and the City of Greater Sudbury use this approach for online voting in local elections. Verification mechanisms are a means of ensuring the election is not tampered with, but cannot prevent all attacks. Although there are many risks with traditional election processes, if one in-person poll using paper ballots is compromised the entire election would not be affected to the extent possible with online voting. Modification of votes and potentially election outcomes can occur on a larger scale with online ballots. In Switzerland, authorities sought to lessen this risk by limiting the availability of online voting to a specific percentage of the population with the thinking that if fewer people voted online, the system would be less desirable to compromise. Since making the move toward E2E, however, Swiss authorities plan to allow online voting for all eligible electors in all elections and referendums where universally verifiable technology is used. A list of common security threats associated with online voting systems that are not present in traditional paper voting at the polls where ballots are counted by hand can be found in Table 1.



Table 1: Security threats to elections not found with in-person, hand-counted paper voting



Threat Description Vote Selling and Coercion The unsupervised nature of internet voting means that others can observe electors while voting, and their vote choice could be unduly influenced. Phishing Online avenues that seek to misdirect voters into visiting misleading or malicious websites, or visiting legitimate websites that are vulnerable to loading malicious third-party content. Automation bias Habituation and lack of knowledge about the goals and purpose of common web security technologies can lead users to place an undue reliance on technological protections and underestimate the significance of warnings or errors. For example, not noticing when the green padlock icon is missing, or clicking through browser security warnings). Denial of Service Occurs when a server is flooded with connection requests from numerous computers or devices. These types of attacks can be mitigated; however, they do occasionally cause significant disruptions. For example, a denial of service attack in 2015 caused Canadian government websites to be inaccessible for several hours. Client-side Malware/Spyware Malicious software on a voter’s computer with the intention of altering and/or surveilling ballot selections. Server penetrations Compromising or attacking the server running the internet voting portion of the election. An attack could be the result of any combination of undisclosed software vulnerabilities, misconfigurations, or human error that would allow a remote attacker to gain access to voter data. An example of a server penetration is IP theft. Insider Influence Risk that insiders (e.g., election officials, vendors or other technical personnel) can view or modify vote choices on the server, making it vital for there to be strong mechanisms to prevent undetected changes to votes. State-level Actors A sophisticated and undetected attack by a state-level actor where an election outcome is changed. Source: This table has been adapted from Dr. Aleksander Essex’s (2016) policy brief on cyber security and internet voting, prepared for the Online Voting Roundtable, held September 26, 2016 in Ottawa, Ontario.

Such security vulnerabilities and possible breaches have the potential to negatively affect public trust in elections. If an election, or part of an election, was compromised because results were delayed or tampered with, there could be a loss of public faith in electoral institutions and processes. It is difficult to predict this impact. At the Online Voting Roundtable some experts suggested that a security breach in a binding election might not affect public trust too much since Canadians have come to expect a certain degree of risk in anything carried out online (e.g. banking).14 In the United States, for example, according to Gallup levels of public trust in elections already reached a low of 28% in May 2016 before allegations of Russian hacking, and were not much higher in 2011 (Zuesse, 2016).15 Furthermore, despite the US intelligence community’s assertion that Russia is responsible for the 2016 election-related hacks, nearly half of Americans say we cannot be sure since the intelligence community was wrong that weapons of mass destruction were in Iraq (Bordelon, 2016). To promote public faith in elections if remote online voting is introduced (or any other electronic-based vote casting or counting technology) there needs to be strong transparency and scrutiny of the process, especially if an outcome is challenged.

Additional administrative elements that can act as barriers to online voting implementation include the challenge of clear requirements, procurement, voters’ lists, voter education and outreach, privatization of elections, trust, and possible disintegration of social capital or loss of the voting ‘experience’. Depending on the type of system used, notably if online voting technology is developed in-house, cost of development could pose a barrier to implementation. Prior to adopting online voting, or any voting reform, parliamentarians and policymakers must think carefully about what they would like to get out of such reform. Identifying clear requirements is an essential prerequisite to a focused trial or pilot, and successful deployment.

Updating administrative aspects such as procurement policies is needed to ensure potential vendors and their proposals are adequately vetted. Modernization of procurement needs to happen regardless whether online voting is used or not, as electoral innovation occurs in other aspects of elections. At a basic level this could involve simplifying procurement processes and moving them online. More specifically for voting, it may involve reweighting selection criteria such as the number of points awarded for proposed project cost, technical standards, and perhaps the involvement of independent experts, such as computer scientists, in the selection process.

Accurate voters’ lists are an ongoing issue in elections in Canada and elsewhere. The introduction of new voting methods often highlights cracks in traditional paper-based voting. Accuracy of the voters’ list can act as a barrier in online voting approaches where voters are mailed a Voter Information Card (VIC) with a unique PIN and possibly other voter information. Issues with the list could mean delivery of VIC’s to incorrect addresses and, depending on the credentials required to authenticate voters, could make it easier for fraud to occur. This has been documented at the municipal level in Canada and in the recent PEI plebiscite on electoral reform. In the PEI plebiscite, officials searched online to find date of birth information for names listed on 20 returned voter cards by visiting sites such as Facebook. They were able to obtain birth date information for one of the electors. This highlights the importance of the accuracy of the voters’ list and the credentials required to authenticate the voter.16

Reaching out and educating voters is a barrier that can be overcome, but requires attention. Engaging stakeholders early and often is important, as well as ensuring the voting system is explained simply and the parameters of voting communicated clearly (e.g., registration deadlines, online voting periods). Getting the message out through marketing and communications can be time consuming and costly but it is needed to ensure uptake of the voting method and promote trust from stakeholders. The privatization of elections is raised as an issue whereby a private company provides technology services for an election for collecting and/or counting votes. This is said to pose another challenge to public trust in elections in the event that electors have concerns about their voting choices and information being handled by a vendor. In some areas, however, privatization is not necessarily a bad thing. Initially testing the technology using a vendor system could save money and time in working to develop a suitable model for the jurisdiction. Furthermore, in the case of Switzerland where two voting systems are used – one that is developed by cantonal governments and another that is supplied by an international firm – the use of two approaches is seen as an advantage in the event someone tried to compromise one system, the entire election would not be affected since the voting schemes are entirely different. These dual systems are explored below, in the case study. Possible disintegration of social capital and loss of the voter experience is a concern if elections move remotely online. Political participation in groups, such as attending a poll location with a group of friends or family, supports personal networks that taking part in activities alone does not (Putnam, 2001). Continuing to offer poll locations with paper voting, and offering polls where online voting is available can mitigate loss of the voter experience. Finally, the barrier cited in interviews as the greatest obstacle to online voting is lack of political will. Support from elected representatives and buy-in from government officials is necessary for the successful adoption of any policy change. Without the political and administrative support to introduce online voting we will not see it used in elections. According to interviews with officials, Austria is an example where there is insufficient political backing for online voting. Overall technical barriers such as authentication, verification, ballot secrecy and auditability need to be managed based on available technology and contextual circumstances, threats to security present additional challenges. Political will is another barrier that can be difficult to overcome if support is lacking. Digital literacy is less of a concern for use, though connectivity could be an issue in some remote areas, notably in the north and Indigenous communities. Finally, older electors vote online, calming worries about members of older cohorts being reluctant to use voting technology. Other possible barriers seem to have been addressed in online voting use elsewhere. The exception is voters’ list accuracy which many Canadian municipalities struggle with. However, correctness of the list is likely improved at the federal level.

4. Technical considerations



In addition to the technical considerations discussed in the previous section, added discussion on the advanced technical elements of online voting is warranted, notably verification, and the potential for new technologies to transform the online voting landscape. This section briefly discusses authentication and verification before moving to a discussion of blockchain technology and the likelihood it will benefit the development of online voting systems.

Strong authentication



Authentication and verification are two key concepts in online voting systems that are important to get right. The approaches used for each of these can depend on the context in which online voting is being used. For example, in what kind of election, the institutional and cultural features of the jurisdiction, and the type of principles that guide elections, such as whether ballot secrecy is highly valued. The country cases below highlight alternate approaches to authenticating voter identities, however it is argued by many that having “strong” authentication requires a layered approach where the user has two or more authenticators. To have “strong” authentication of a voter two of three items are required: Something you know E.g., your birth date, place of birth, answer to a secret question

Something you have E.g., your voting card and codes

Something you are E.g., your fingerprint This approach is used in Switzerland (Chevallier, 2010). In Canada, this process must be thought through carefully. Options like biometrics would not be an option at this point given that the government maintains very little biometric data on citizens.

End-to-End Verifiable Internet Voting (E2E-VIV)



The emerging approach to voting systems is verifiability (US Vote Foundation, 2015).17 At the outset of remote online voting trials no voting systems had verifiability but some systems have introduced it to improve security and protect electoral integrity. Norway was the first country to try universally verifiable voting, though after two trials in selected municipalities in local and national elections, pilots have now been terminated as the current government regards online voting and the secret ballot as incompatible (Government of Norway, 2014). Currently, some systems use individual verifiability and are preparing to launch versions that enable universal verifiability (e.g., Estonia in 2017 and by 2018 in Switzerland, see more discussion of this in the country cases, below). While technical experts state that individual verifiability is important, there is near “universal” consensus that an E2E verifiable system is necessary for electoral integrity and proper auditability. The idea of universal verifiability is premised on having evidence-based results or proof for the voter that their vote made it into the ballot box as they intended, and that anyone can establish that the votes were tallied correctly.

In practice, the two principles of being able to verify votes are cast as intended and tallied as cast take place in three phases or steps whereby voters can check that their ballot was cast an intended, recorded as cast and tallied as cast: 1. Cast as intended – at the time of voting, voters are provided with evidence, often in the form or a receipt or code, that their encrypted ballot reflects their voting choice. 2. Recorded as cast – voters can check that the encrypted ballot has been included correctly by seeing the encrypted code they cast on a public list, which shows the encrypted votes that have been cast. 3. Tallied as recorded – “any member of the public can check that all the published encrypted votes are correctly included in the tally, without knowing how any individual voted” (Benaloh et al., 2014). The first and second steps often involve providing the voter with a code/ “receipt” upon finalizing the casting of their ballot, which they can use to carry out this check. The third step relies on mathematical proofs, and either mixes the ballots by removing voters’ personal information and decrypting the votes, or uses something called “homomorphic encryption” which allows for the votes to be tallied without decrypting them to verify the tally is correct (Benaloh et al., 2014). The key to this third element is being able to ensure the election results were tabulated correctly without revealing any additional information about the votes or voters. Blockchain is often presented as one type of technology that could facilitate verification.



Blockchain



There is a lot of enthusiasm surrounding the potential of blockchain to revolutionize online voting. Many assert that blockchain is the “missing link for transparent, verifiable election systems” (Nasser et al., 2016) and point to its potential to detect tampering of any kind. Yet among the technical experts interviewed for this report there was unanimous agreement that while blockchain is very useful and can contribute to improving or perhaps eventually solving some issues with online voting, it is by no means a panacea that will magically address problems or concerns with the technology. A recent study by Nasser et al., (2016) further emphasizes this point, by stating: “blockchains are a useful augmentation to verifiable voting in some circumstances and may introduce interesting ways of voting in non-traditional settings; but on the other hand, blockchains are not a panacea” (1).

Blockchains are a cryptographic technology that have been around for more than 40 years18 but have attracted recent interest given the fascination with Bitcoin. Scholarly literature points out that defining blockchain is challenging and a firm definition is “far from clear” (Mattila, 2016). A Berkeley Engineering Sutardja Center for Entrepreneurship & Technology Technical Report (2015) provides a simple definition and explains that blockchain refers to:

A blockchain is essentially a distributed database of records or public ledger of all transactions or digital events that have been executed and shared among participating parties. Each transaction in the public ledger is verified by consensus of a majority of the participants in the system. And, once entered, information can never be erased. The blockchain contains a certain and verifiable record of every single transaction ever made. Bitcoin, the decentralized peer-­to-peer digital currency, is the most popular example that uses blockchain technology.



The report goes on to provide a simple analogy that explains the value of blockchain technology: stealing a cookie for a cookie jar is easy if the jar is secluded, however, stealing a cookie from a market that is observed by thousands of people is more difficult (Crosby et al., 2015). The characteristics of blockchain are seen as useful in instances where a transparent and irreversible transaction record is required (Bracamonte, Yamasaki and Okada, 2016). Specifically, elements such as distributed verification, decentralization, transparency and irreversible transactions are qualities of blockchain that have been identified as useful to contribute to the criteria online of voting systems such as uniqueness of the vote, verifiability and auditability and vote integrity, among others (ibid.)

Here are some examples of how blockchain can contribute to improved online voting: The Bitcoin network can prevent double spending of assets. Using a transaction to represent a vote for a specific candidate could protect the uniqueness of the vote.

Open source approaches to online voting are often favoured because they enhance transparency. A Bitcoin’s code is open source and everything that comes through the system is traceable, making it highly transparent. 19

Having a verifiable audit trail is recommended to ensure votes are cast as intended. Some argue having a paper receipt is the ideal audit trail for electronic voting. Bitcoin blockchain keeps a record of all transactions with the ability to view and track them. This could enable verifiability by allowing voters to check the transaction record to verify their vote. As explained, below, however, the transaction record presently reveals too much information for binding elections.

Once a transaction is recorded in the Bitcoin blockchain it is considered irreversible. Applied to voting, once a voting transaction was added to the blockchain and confirmed20 it would be difficult to modify or delete voting records21 (Bracamonte, Yamasaki and Okada, 2016).

There are a number of blockchain voting projects22 but experts argue they are not yet comparable to systems that offer E2E verifiability.23 A recent paper on blockchains and voting explains how a blockchain voting system operates:

Voters register a Bitcoin address with the election authority (EA). The EA publishes a list of addresses but does not list which address belongs to which voter. Each candidate also specifies a Bitcoin address. Voters then cast a ballot by sending a small payment to their selected candidate. Any deviation from the voting rules (e.g., one vote per voter) can be seen by inspecting the blockchain, and the tally is visible by inspecting the candidate’s received payments.

The primary benefit of this approach is that votes are cast on a global network of computers that is decentralized, and not affiliated with election authorities so the system is distributed and independent. By contrast, a key disadvantage is that the registration authority is privy to information about the voting transactions that could breach voter privacy 24. Ballot secrecy can also be compromised since the time each vote is cast is tracked on the ledger, which could allow for tracking or possibilities for fraud such as vote selling and voter coercion or intimidation. Another disadvantage is that “votes can be seen as they come in” which enables transparency but also tallies by particular candidates. Some systems argue there are benefits to this, however in Canada’s current system a live tally of the results is not permitted. Third, the ability to carry out voting transactions can be done more simply in other systems than through a standard Bitcoin transaction (Nasser et al., 2016). Finally, instead of passwords, blockchains require something stronger called a cryptographic key, which would be stored on a voter’s computer. Kept on a computer the key would be vulnerable to being lost or stolen by malware. While this is not an exhaustive list of drawbacks of bitcoin-based voting systems it raises questions about the usefulness of this approach for voting.

A final consideration is the complexity of such a system. One issue with most electronic or online voting systems is their complexity, which can make it difficult for the average voter to understand how things work. The blockchain approach seems additionally complicated which would provide less transparency for the voter. In addition to the operational issues, at this point blockchain is not able to address a number of security concerns outlined earlier in the report. An open letter on blockchains written by a group of computer scientists identifies the issues and security threats blockchain cannot address now, or in the foreseeable future, see Table 2.

Table 2: Technical issues blockchains cannot solve



Transparency Facilitate observation of the process. Authentication Ensure that only legitimate voters are authenticated and can vote. Verification Allow voters to verify that their votes were recorded as cast. Security Distributed denial of service (DDoS) attacks on the election infrastructure;

Possible hacking of election infrastructure such as election servers and voter registration databases;

The presence of malware or spyware on voter’s personal computer or device;

Insider influence;

Vote selling or coercion; and

Phishing (prevent voters from accidentally providing their authentication information to fraudulent sites). Source: Content for this table was adapted from Joe Kiniry et al., 2016.

A final issue raised in expert consultations that is unique to blockchains, specifically cryptocurrencies, is the proof-of-work the system uses which relies upon people donating computer power for a financial incentive and ensures that no one individual can take control of the blockchain. This set-up is premised on the fact that there is more collective good than there is bad. However, if those with malicious intent gained control of more than 50% of the total computing power they would have the ability to change the transaction history.25 Lack of the financial bitcoin incentive, and possible competing interests over the outcome of an election, raises concerns about control of the blockchain.

Overall, blockchains are a useful technology that can contribute toward enabling a secure voting solution and improving parts of online voting systems, but there is much they cannot address and they are not the silver bullet to delivering issue-free online voting (Kiniry et al., 2016).26 There is also a lot we do not know about blockchain that future research and development can help to understand and apply.

5. Country cases: Canada & international experiences



There are many jurisdictions that regularly use or have tested online voting. While three of the most prominent – Estonia, Switzerland and the US – are addressed here, remote online voting is presently used in ten countries at various levels of government or for various segments of the voting population: Australia, Canada, Estonia, France, India, Mexico, Armenia, Panama, Switzerland and the United States. More than twenty countries have trialed internet ballots, with fifteen of these adopting remote online voting and continued announcements about future plans to implement the technology in places such as Finland, Moldova and Åland, an autonomous region of Finland. Online voting is not a fringe development but is becoming part and parcel of electoral modernization in jurisdictions where it is an appropriate fit and where the necessary preconditions for implementation exist. This section provides a brief overview of online voting developments in Canada followed by an assessment of comparative experiences in Estonia, Switzerland, and the United States.

Canada: a brief overview



In Canada online voting has been used predominately for local level elections and votes – in municipalities and Indigenous communities – and was recently used in a 2016 plebiscite on electoral reform in PEI. Municipally online voting has been deployed in 200+ local elections in the provinces of Ontario and Nova Scotia since 2003. So long as the Municipal Elections Act, which is written by the provinces, possesses the necessary legislative clause to permit online ballots, municipalities are able to decide whether or not to adopt online voting. There are no minimum standards or regulations regarding online voting use at the municipal level. The number of communities implementing the voting method has nearly doubled with each election since its initial adoption: 97 of 41427 Ontario municipalities used it in 2014 and 23 of 51 made online voting available for electors in the 2016 Nova Scotia municipal elections.28 The top three rationales municipalities cite for adopting the voting reform include accessibility, improvements in voter turnout, and convenience. Other considerations such as simplifying election administration, decreasing election cost, focus on citizen-centered service, accommodating seasonal residents, showing leadership in e-government, greater youth involvement, environmental considerations and counting efficiency are mentioned (Goodman and Pyman, 2016).

Overall, administrators are satisfied with adoption and would recommend using it again. A 2015 study of Ontario municipalities that used online voting found that 96% of those surveyed were satisfied with the voting method. As part of the same survey, officials reported convenience, accessibility and counting efficiency as the main benefits from an administrative perspective and public outreach and education, negative media and potential for fraud as the biggest challenges (Goodman and Pyman, 2016).

In terms of the types of online voting models that have been adopted there has been a lot of policy borrowing municipally. In Ontario, for example, later adopters have often emulated the approaches taken by small and large municipalities in the first deployment in 2003. Generally, municipalities with electorates of 100,000+ offer online voting in the advance portion of the election, while smaller communities have a tendency to extend online voting through to Election Day (Goodman and Smith, 2016). The voting process and types of ballots are two additional elements that distinguish municipal models. Larger places usually require registration to vote online, while smaller places do not. Further, online voting is commonly used as a complementary voting channel in cities whereas paper voting is often, but not always, eliminated in smaller townships and replaced with a combination of online and telephone voting. These observations are not present in every case, but generally there are distinct patterns of adoption for large and small municipalities. As more communities adopt online voting some different models are being investigated and implemented.29

In addition to municipal developments, use by Indigenous communities in Canada is growing. Approximately 20 First Nations have deployed online voting for Chief and council elections and other types of votes (e.g., ratification and agreement votes, plebiscites or referenda). While communities are free to use remote online voting for local consultations and other types of votes, overarching legislation needs to be in place for use in elections. Communities governed by the Indian Act, or that have opted into the First Nations Elections Act, do not have the legislative basis to employ the technology for Chief and council elections. Those governed by custom codes or self-government agreements, however, are able to (e.g., Mississauga First Nation in Ontario and Talthan and Ucluelet First Nations in British Columbia have used online voting for Chief and council elections). Many communities would like to proceed with online voting for Chief and council elections since reaching off-reserve members can be difficult and geographic size and rural areas can make reaching on-reserve members challenging. An example is the Mohawk Council of Akwesasne whose territory spans Ontario, Quebec and New York State. Amending the Indian Act and First Nations Elections Act would be an important step toward increasing Indigenous autonomy over their voting processes and allow communities to adopt measures to improve voter access. Though research on Indigenous communities’ use of online voting is emerging, early studies have found it has a positive impact on self-determination and those that have used it would be likely to offer it again (Gabel et al., 2016). Key takeaways from the Canadian experience:

High levels of online voting satisfaction among voters and election administrators;





Of possible ballot types – online, paper or telephone – online is the most popular voting mode among municipal voters in Ontario;





Compared to other types of remote voting including telephone voting and voting by mail, voters perceive online ballots to be the least risky;





Internet voters surveyed say they would vote online in municipal (98%), provincial (95%) and federal (94%) elections;





Online voting attracts habitual voters for reasons of convenience;





Online voting engages some infrequent voters in the voting process;





From the perspective of election authorities the main challenges for electors are: familiarity with computers and the internet, learning a new voting method, and potential for fraud;





There are no technical standards or regulations regarding online voting use municipally but they are needed. Expansion of online voting to the provincial level emphasizes the importance of this point;





Smaller communities are drawn to online voting more so than larger ones, albeit there are more of them;





Some Indigenous communities that have used online voting say it has helped to advance self-determination;





Many Indigenous communities are prevented from using online voting for Chief and council elections. Amending the Indian Act and First Nations Elections Act to allow for the use of alternative voting channels would be an important step forward.

Case studies



Estonia



Estonia is the first country to use internet voting for all government elections – local, national and extra-parliamentary, and the first jurisdiction to adopt ivoting on a national scale. Estonia is also one of three countries with established online voting systems and the only one where online voting is used in national elections on a permanent legal basis. Although Estonia is a much smaller country than Canada, the evolution of the online voting system can teach Canada a lot about development.

Early adoption

Online voting development in Estonia has been relatively centralized. First used in 2005 for nation-wide local elections, the voting reform was quickly adopted wholesale for national and extra-parliamentary elections. Over the past ten years eight elections have been held that permitted voting by internet. Growth in use has expanded significantly over that time period from about 2% (9,317) of those that voted in the first deployment in 2005 to more than 30% (176,491) in the 2015 parliamentary elections (Vassil et al., 2016; Vinkel, 2016). Online voting in Estonia is available for all eligible voters and is only available in the advance voting period. 30

Considered to be “a pioneer in e-governance and e-democracy” (Madise and Martens, 2006) the rationales for adoption in Estonia were to increase the number of voting methods, make voting simpler and more convenient for electors, and to improve turnout and feelings of political alienation, especially among young people. The policy change was part of a shift focused on citizen-centric service and inclusiveness. It was also to build upon Estonia’s highly technical culture, leveraging digital infrastructure to further modernize society (Goodman, Pammett and DeBardeleben, 2010).

Technical and operational developments Estonia’s online voting approach is based upon the country’s Electronic ID Card (eID), which is the cornerstone of all its e-service provision, Figure 3. The eID cards are compulsory for every Estonian citizen or resident over the age of fifteen. While about

60-70% of the population had cards when online voting was first used in 2005 (Madise and Martens, 2006) to date all eligible voters have been issued a card (Vinkel, 2016). Cards are used for physical and digital identification for banking, as a public transportation ticket, for picking up e-Prescriptions, and as valid travel document for Estonian citizens within the European Union.

Figure 3: Estonian Electronic ID Card



Source: Kristjan Vassil, 2016, World Bank Report

Text version An Estonian Electronic ID card with personal information, micro-chip, picture, and signature.



The eID operates with an electronic chip and two pin codes (Vassil, 2016). The first pin (PIN1) provides personal authentication, confirming the user’s identity, while the second pin (PIN2) enables a digital signature. Many e-services are accessed with only the first pin (e.g., reviewing health records). The second pin is needed where a signature is required or to approve online transactions (e.g., a tax declaration or to vote online). To vote electors require a computer with an internet connection and a “smart-card reader”, which can be purchased for less than 10 euros at supermarkets or electronics stores (Vassil and Solvak, 2016). Electors must also download a voting application to their personal computer, which is a standalone program for online voting. To access the system the user first identifies themselves using the eID card and a four-digit PIN (PIN1) which verifies that the user is eligible to vote. The user then completes his/her voting choices and the vote is encrypted by the online voting application. To cast the online ballot, users must provide another five-digit pin (PIN2). The vote is then certified by the system and sent to the server to be counted at a later time (Vassil and Solvak, 2016; Vinkel, 2016). Before tallying the votes, the encrypted vote and the digital signature are separated, removing all personal data, Figure 4. This approach is akin to the double envelope scheme commonly used for mail voting. Encryption is based on a public and private key. When the voting application encrypts the vote with the public key it can only be decrypted by the private key that is held by the Estonian National Electoral Committee (ENEC). The anonymous online ballots are counted after the close of polls on Election Day (Vassil and Solvak, 2016; Vinkel, 2016).

Figure 4: Estonia’s double-envelope approach to online voting



Source: Kristjan Vassil and Mihkel Solvak, 2016

Text version Image that illustrate how the double-envelope approach applies to online voting in Estonia. The encrypted vote (the first envelope) is included in the digital signature envelope with the use of the public key. The information related to the e-voters and e-votes are separated. With the private key, the evotes are compiled to obtain the results.

If electors do not have a card reader they can vote online from public access points such as a public library or community centre. Since 2011 it is also possible for Estonians to authenticate themselves using a mobile ID. This uses the same technology as the eID card.31 SIM cards for mobile devices are issued by the government, distributed to vendors and sold to the public. By connecting the mobile device to the computer, a voter’s mobile ID can be used to digitally identify the user on their personal computer. While this technology can be used for a range of e-services, voting in Estonian cannot be done from a mobile device at this time. So, while a user can authenticate his/her identity by linking their mobile device with their computer, if for example, they do not have a computer card reader, they must cast a ballot from their computer. The voting application only works on PC, Mac or Linux operating systems (Vinkel, 2016).

The first five online voting elections were similar from the user’s perspective except that the number of advance voting days was extended from 2009 onwards from three to seven days. The requirement to download the voting application was implemented in 2009, prior to that voters would cast online ballots from a web-embedded application. In 2013, individual verifiability was added that enables voters to use their smartphone or tablet to confirm their ballot was cast as intended (Vassil and Solvak, 2016). Estonian authorities have used the two and a half years between each election to update the online voting system with larger changes being made at the beginning or end of the three phases of online voting development. Priit Vinkel (2016) identifies three phases of the Estonian process: (1) set-up and implementation, (2) increasing number of online voters, (2) the introduction of verifiability and stabilization of online voting. The initial phase began in 2002 with the establishment of the legal framework to start online voting planning and ended with the commencement of online voting in 2005. From 2005 to 2011 the number of online voters increased by about 4.3 percentage points with each election. When 25% of all votes were cast online parliament legislated the specific legal norms of online voting to enhance legitimacy and transparency of the system. An Electronic Voting Committee was written into law in 2012, and in 2015 legislative amendments were made to mandate that voters be able to verify their ballots were received and recorded correctly.

Future plans and lessons learned Having launched individual verifiability, the ENEC has been working on universal verifiability. To add E2E verifiability, Estonian authorities are presently nearing the end of a complete redesign of the online voting system that is expect to launch in the fall of 2017. The new version introduces a number of security measures and offers auditors the option to mathematically check that the votes have been counted as recorded. Changes of this scale required a new base for the system, which meant new code. For the voter, however, the user interface stays exactly the same to promote trust in the technology and integrity of the ballot box. In terms of effects on voters, for the first few online voting elections online voters were younger, had higher digital literacy skills and were mostly native to Estonia. After that point, however, there was a shift in the make up of online voters as socio-economic factors became less pronounced and online voting “diffused homogenously among the voting population” (Vassil et al., 2016). Despite this diffusion, those with higher levels of digital literacy are more likely to vote online. Data from 2013 and 2015 suggest that the average online voter is between 35-45 years old, with online turnout among the 18 to 25 year old being quite low. For many it really is about convenience – those living near a polling location are more likely to vote by paper, while those living more than 30 minutes away are inclined to vote online. Finally, online voters are more faithful to the voting method than paper voters and many continue to stick with the voting method (Vinkel, 2016). Key takeaways from the Estonian case:

Online voting is a complementary voting channel;





The online voting system in Estonia is based upon the national ID card as the key piece of infrastructure;





Digital infrastructure plays an important role in the adoption of digital policy change;





Development takes time and should not be rushed;





The technology must be continuously updated and changes must be made as the online voting system matures to maintain electoral integrity and public trust; and





The legal framework should be revisited periodically and updates enacted to correspond with technical changes or system maturity. In the future, Estonian authorities have no plans to replace paper voting in elections and online voting will continue to be offered as a complementary voting channel. As a next step officials plan to enable voting from mobile devices.

Switzerland



The Swiss model is interesting for a few reasons. For one, Switzerland is a federal state and online voting adoption has been consistent with the constitutional framework. Second, postal ballots are well entrenched, fostering a culture that is open to unsupervised voting. There is also a mail out component as part of the online voting process that has similarities to the circulation of the Canadian VIC. Third, the development of online voting in Switzerland has been gradual and tightly controlled, yet has made regular progress and adapted to address the same challenges as Estonia, but in different ways. Finally, two different online voting systems operate in Switzerland, one developed by government (often referred to as the ‘Geneva system’ since it started in Geneva) and the other, which is a vendor-based system (previously identified as the ‘Neuchâtel system’ now referred to as the ‘Swiss Post system’)32 . This section discusses developments in Switzerland with particular attention paid to the Geneva system since it is considered advanced and because the Neuchâtel system is presently undergoing a transition having recently been taken over by the cantonal postal service provider, Swiss Post. The Swiss Post system will continue to operate using an upgraded version of technology from the same vendor that has supplied the system since its adoption.33

Early adoption

Government motions establishing the legal framework for e-government and online voting were carried out in the early 2000s. National laws, ordinances and guidelines regulate elections in Switzerland; however, the cantons are responsible for carrying out elections and referendums with the cooperation of the municipalities.34 The first online voting trials occurred in the canton of Geneva in 2003, followed by trials in municipalities in Neuchâtel and Zurich. The federal government provided about 80% of the funding needed for initial pilots and each canton had autonomy to develop their own online voting approach. This resulted in three different online voting models. Since 2005 online voting has been trialed in the three pilot cantons for elections and referenda at all three levels of governments. In 2008 online voting was extended to citizens abroad, first in Geneva and then in other cantons (Serdült et al., 2015; Serdült, 2016).35 Overtime, additional cantons joined one of the three pilot cantons to offer online voting, which offset the financial burden. In 2015, the Zurich system did not pass a security audit and was not able to offer online voting in the general election affecting nine cantons that were part of the Zurich consortium. The technical issue was “not related to the internet voting solution per se but to the interfaces with electoral management systems and the municipal vote registries” (Serdült et al., 2015:127).36

Rationales for ad