WA's decision to allow internet voting in state election is a very positive step

The WA Electoral Commission has made a significant move towards internet voting for all by allowing people with an incapacity or disability making it difficult to vote, or vote in secret, to vote in the upcoming state elections via the internet.

The iVote system developed by the New South Wales Electoral Commission, and has been used since 2011 in all state by-elections. It allows people to vote via the Internet or through the use of a phone using touch tones.

In the upcoming WA state election, people who:

• Have insufficient literacy skills
• Are sight impaired
• Are otherwise incapacitated

can register to vote using the iVote system. Once registered, voters get an 8 digit iVote number and a 6 digit PIN. They use this to log into the system to vote and once having voted online, can verify their vote through an automated telephone system.

The move by the WA Electoral Commission to go ahead with Internet voting is even more positive a move when taken in the context of the public relations disaster of the Australian Bureau of Statistic’s attempt to run the Australian Census online last year. The fear was that the appalling way in which that particular project was run would be the death knell to any future hopes of introducing innovation into the way elections were run.

The iVote system itself has not been without its own controversy. In the 2015 NSW State election, researchers Alex Halderman and Vanessa Teague revealed a number of security flaws with the system at that time. After informing authorities of the potential weaknesses in the system, the NWS Electoral Commission patched the vulnerabilities but only after 66,000 people had voted. The researchers noted that the final seat was decided by a margin of 3,177 votes and so the potential for tampering with the voting process at that time could theoretically have made a difference to the election outcome.

It must be stressed that the means by which the vulnerabilities could have been exploited in the NSW election would have been particularly difficult to pull off on a sustained scale, especially without any signs of detection.

This is perhaps the main point. It is one thing to suggest that there are vulnerabilities in a system, it is completely another to suggest that they can be exploited without leaving any trace or raising any suspicion.

In the US presidential election, accusations of vote tampering through hacking of electronic voting systems were met with skepticism. Even Edward Snowden said that:

“Hacking voting machines: not that difficult. Hiding a secret deviation in votes from after-the-fact statistical analysis: nearly impossible.”

Although no system can be declared 100% secure, it is wrong to think that there has been nothing learned about how to run secure systems and write secure software. There is sometimes the assumption that hackers are the only group that has been improving their techniques of practice. This is of course patently untrue.

There is also the point, missed in discussions on the risks involved with Internet voting, of the balance between the benefits of running an electronic voting system and the risks, including an assessment of the likelihood that anyone would be particularly interested enough in the outcome to invest time and money into influencing its outcome.

In the case of allowing people with vision impairment and others whose incapacity prohibits them from voting in secret in the elections is a major benefit for those involved. This has to be coupled with the fact that the NSW iVote system has been running for 6 years without any evidence that it has been interfered with.

It has been estimated that 95% of security incidents are due to human error, with a large number of those incidents involving persuading non-security staff to given up access information or to inadvertently install malware. In these attacks, it is often sufficient to just get one person to do the wrong thing. In the situation of electronic voting, attackers have to do get potentially thousands of individuals to do the wrong thing in order to influence voting in the way suggested by people concerned with the flaws of Internet voting.

Of course, it is possible that hackers could exploit a “zero day vulnerability” of some sort and access the machines running the electronic voting. They could potentially change votes at this point and try to cover their traces. They would need to do this in a way that kept the voting patterns consistent, to avoid raising suspicion of interference. Not only that, but they would need to know about, and be able to change all forms of auditing of the voting to make sure that any checks done on the results were consistent. As Edward Snowden pointed out, this becomes “nearly impossible”.

The introduction of Internet voting for a small group of people in state elections is a good start, but still a long way from allowing Internet voting in federal elections. One can only hope that the successful use of Internet voting, even in a small way, will encourage politicians to push for its more pervasive use in future elections.