Secrétariat général

Directorate General of Democracy and
Political Affairs
DIRECTORATE OF DEMOCRATIC INSTITUTIONS
Project “Good Governance in the Information Society”

GGIS(2010)14
English only / anglais uniquement

Strasbourg, 9 November 2010

Third meeting to review developments in the field
of e-voting since the adoption of Recommendation Rec(2004)11 on legal, operational and technical standards for e-voting

Palais de l’Europe, Strasbourg
16-17 November 2010

ELECTRONIC VOTING PILOT IN THE 2008 MUNICIPAL ELECTIONS IN FINLAND

Contribution by Finland

ELECTRONIC VOTING PILOT
IN THE 2008 MUNICIPAL ELECTIONS IN FINLAND

1. Introduction

In Finland, an electronic voting (below e-voting) pilot was implemented in three rather small municipalities (Karkkila, Kauniainen and Vihti) in the electoral district of Uusimaa in connection with the municipal elections on 26 October 2008. The objective of the pilot was to enable voting with a voting terminal at the polling station to speed up the voting procedure from the point of view of the voter. The pilot also was aimed to enhance the security of advance voting (by eliminating the need to transport or handle the sealed ballots), enable faster vote count, reduce the work of the election authorities and, in the long run, achieve possible cost savings.

The IT supplier of the entire voting system was TietoEnator PLC, today Tieto PLC, with Scytl Secure Electronic Voting S.A as its subcontractor.

Considered as a whole, the Finnish e-voting pilot was not a success. Because of the flaws in the e-voting procedure, the Supreme Administrative Court ordered new elections to be held in the pilot municipalities. However, the experiment showed some of the weaknesses and possible strengths of e-voting.

2. Some basic elements

The e-voting took place at the polling stations in front of the election authorities. Remote internet voting was not an option. The voter had the right to choose between the voting terminal and the paper ballot.

Election authorities used the election official’s application to check the voters right to vote in the voting register (franchise data). The election official’s terminal was a standard PC that had been booted from secured read-only media. The terminal included a card reader to manage the e-voting smart cards.

The voting terminals were connected to a centralized “electronic ballot box”. In the polling booth there was a touch screen user interface. The voter used the Voting Application to cast the e-vote. This application registered the digital e-vote, provided a digital signature and sent the e-vote to a central server via the internet. The e-vote was saved on the central server in an encrypted format until the vote count. At this stage, the e-vote contained information both about the voter and the vote.

A mixing application was used when decrypting the e-votes to break the connection between the vote and the voter to ensure voter privacy. This process was executed under the authorities’ supervision in an isolated environment with no physical connection to any other computer environment.

The core elements of the e-voting system were based on the Linux operative system. The e-voting system was integrating Pnyx.core software with the Election Information System that has been used for several years in general elections in Finland. The source code of the voting system was not open. The reason for this was that according to the enquiry made when the pilot project began in 2005 no open source systems advanced enough were available.

A voter-verified paper trail was not used because it was considered that this may have endangered the secrecy of the vote in the advance voting. Instead of a paper receipt, the voter received verification on the screen of the voting terminal when the vote had been cast successfully. For this reason, a recount of e-votes was not possible and the voters could not really ensure whether their vote had been correctly registered in the system. The voters had to trust that the equipment, the software and the officials operated as intended although in unclear situations the election official could check that the voter’s right to vote had been registered as used in the system.

3. The voting procedure

The election officials identified the voter through his / her identity card. Then the official registered in the system that voting had started and gave a smart card to the voter that allowed him / her to cast one vote.

In the ballot booth, the voter put the voting card into the card reader to identify him- / herself. Then the voter entered the candidate's number¹ by using the numeric keys after which the system showed the information of the chosen candidate (name, candidate number, the profession and the party which had nominated the candidate) on the screen. If a voter wanted to cast an empty vote, he / she had to press a certain button designed for this purpose. The voter had to confirm his / hers choice by pressing the visible OK button on the screen. It was also possible to cancel the choice by pressing a certain button and in this case the system returned to the previous screen and the voter could enter the candidate's number again. After pressing the OK button, the system gave a message that the voting had successfully been finished and requested the voter to remove the voting card out from the card reader and to return it to the election official.

4. Auditing of the voting system

On the assignment of the Ministry of Justice, the Department of Mathematics in the University of Turku audited the voting system. The auditors signed a non-disclosure agreement not to publish suppliers business or trade secrets. The Ministry of Justice also invited a critical NGO (Electronic Frontier Finland), a Member of Parliament and a highly experienced IT expert to observe the work of the audit team, but they refused to participate as they were not willing to sign the non-disclosure agreement required by the IT suppliers.

The completion of the audit took a total of 10 man-months. The audit report was published on the Ministry of Justice web site before the elections.²

5. The Elections

Altogether 12 234 e-votes were cast which was 58 % of all the votes cast in the local elections.

Advance voting

During the advance voting period³, altogether 4 985 e-votes were cast. The ministry did not get any immediate feedback from the voters. Neither the electoral officials nor the IT support reported any problems. The only exception was the voting bus where due to inoperative data communications only 44 e-votes were cast and the rest voted with paper ballots. The media had very positive reactions during the whole advance voting period: the voters had regarded the system as user-friendly and easy to use.

Voting on the Election Day

During the Election Day, altogether 7 249 e-votes were cast, no problems were reported in the use of the e-voting system.

The events after the Election Day

Late in the evening on Election Day, a citizen who had e-voted, sent an e-mail to the chairman of the central election committee of one of the pilot municipalities. He argued that the e-voting system seemed to be unreliable. After voting electronically, he had returned to the polling station to check whether his voting had succeeded and it seemed that his vote had not been registered for some reason. The citizen in question voted electronically again, this time successfully. He suspected that there could have been other similar cases.

The next day TietoEnator PLC investigated the matter and reported of altogether 232 cases in which the e-voting had started but it seemed that there was no registration of the use of the franchise of these voters. The Ministry of Justice published a press release about this. According to TietoEnator it seems that in these cases the voter, for one reason or another, had removed the voting card from the card reader before confirming the choice by pressing the OK button. The system did not give the voter an error message in these situations. The interrupted voting was not registered in the electronic ballot box or the voting register. The reasons why the card had been prematurely removed is not known.

6. Appealing

After this five appeals were lodged with the Administrative Court of Helsinki. The court dismissed the appeals. Four continued appeals were lodged with the Supreme Administrative Court. In its decision of 9 April 2009, the Supreme Administrative Court ruled the case in favour of the appellants and ordered new elections to be held in all three pilot municipalities. New elections were held on 6 September 2009. This time e-voting was not an option.

7. Some details of experiences

Costs of the pilot project

The total costs of the project in 2005-2008 were 1 630 550 euro.
This consisted of the following:

- IT supplier 1 330 872 euro,
- Auditing 141 882 euro,
- Materials: ballot booths 70 102 euro and voting cards 10 076 euro,
- the compensations for extra costs to the pilot municipalities 77 618.

Document secrecy

The Ministry of Justice published on its web site the technical documents of the e-voting system. However, according to the Act on the Openness of Government Activities (621/1999) it was not possible to publish such documents which contained business secrets or trade secrets of the suppliers or documents relating to or affecting the realisation of the security arrangements and data communications systems, unless it was obvious that access would not compromise the achievement of the objective of the security arrangements.

The Ministry of Justice received some requests of access to the e-voting documents. The ministry refused the requests partly because the asked documents contained descriptions of the security solutions of the e-voting system and business secrets of the companies which had delivered the system. The decisions of the Ministry were appealed to the Supreme Administrative Court, which dismissed the appeals.

The conclusion is that a situation, where a citizen wants information about the e-voting system in order to make sure that the system acts correctly, but where the authority cannot allow access to the information, cannot be considered satisfactory. In addition, in an e-voting system similar to the one used in the pilot, there is no direct way for the voter to make certain that the vote cast is registered and counted appropriately.

Did e-voting have a positive influence on the voting turnout?

The e-voting had no evident influence on the voting turnout in the pilot municipalities. In Karkkila, the voting turnout was 59.7 % (in the 2004 elections 59 %), in Kauniainen 75.7 % (74.9 %) and in Vihti 58.3 % (56.8 %). In the whole country, the turnout was 61.3 % when it was 58.6 % in the previous elections in 2004.

The e-voters were divided by age as follows:

Age

Number of
e-votes

Proportion of e-votes

Proportion of e-votes in the age group

18-29

1502

12,3 %

73,1 %

30-39

2265

18,5 %

74,1 %

40-49

3147

25,7 %

71,2 %

50-59

2690

22,0 %

61,2 %

60-69

1884

15,4 %

51,6 %

70-79

617

5,0 %

31,8 %

80 and upward

129

1,1 %

15,6 %

12 234

The voters' experiences

A Gallup opinion poll was performed after the elections (27 October – 3 November 2008) among those enfranchised in the pilot municipalities. The respondents considered the e-voting system extremely user-friendly (77 % of those who answered considered it extremely easy and 21 % fairly easy). The use of the voting terminal (the use of the screens of the voting terminal) was considered easy (86 %) or fairly easy (12%). The use of the touch screen was considered extremely easy (82 %) or fairly easy (14 %). Of those who e-voted, 84 % answered it to be probable and 11% rather probable to e-vote also in the future.

Data communications

Based on the general operational reliability of commercial connections in Finland, it was assumed that the probability of an extensive and long interruption of service during the pilot elections was small. According to the auditors, a data security attack, e.g. a denial-of-service attack, targeted against the key equipment of a specific operator could have been possible. An attack targeted against the web servers maintained by the connection link operator could also have affected the operating reliability of the data communications connections used in the elections.

Procedure when opening the ballot box

When opening the electronic ballot box, the screens were reflected on two silver screens so that every one present could see what commands were given and how the computers were functioning. The experience was that in practice only an IT expert could understand the significance of the measures taken. More transparent procedures should be developed for this purpose.

Other experiences

Improvement of the election certainty:
Considered as a whole the election certainty weakened drastically because of the 232 interrupted e-votes. However, apart from the 66 cases in which a blank vote was cast, there were no invalid ballots.

Speeding up the voting process:
A majority of the voters considered the voting procedure was user-friendly.

Simplifying, reducing and speeding up the work of the authorities:
As a whole the amount of work of the election authorities was not reduced.

Cost savings:
No cost savings were achieved in the pilot.

Open source code
To be able to estimate the functioning of the voting system, it would require the skills of an advanced IT specialist and fully transparent access to the system source code.

7. Concluding remarks
In January 2010 the Cabinet decided that in Finland development of e-voting at polling stations will not be continued for the time being, but instead the current election system will be maintained. Close attention will be paid to the international developments in the area of e-voting. In light of the gained experiences, the overall advantages of e-voting at polling stations are not so significant that they would prompt further development of the system.
If it is decided, based on the international experiences, that development of e-voting will be continued, it will most likely concentrate on internet voting (remote i-voting). However, where remote i-voting is concerned questions relating to the secrecy of the ballot⁴ and electoral freedom remains to be solved. If a decision to launch a pilot project on remote i-voting will be made, the pilot could take place in the municipal elections in 2016 at the earliest.