Appeared in the Toronto Star on March 8, 2010 as Hackers, Viruses Threaten Online Voting Validity

With the increasing shift from analog to digital, some elections officials are unsurprisingly chomping at the bit to move toward Internet-based voting.  Last year, Elections Canada officials mused about the possibility of online voting trials, noting the potential benefits of increasing voter participation, particularly among younger demographics.

More recently, the province of Alberta opened the door to incorporating new technologies into their voting processes as part of an electoral reform package.  New trials would require the approval of a legislative committee, but the province's Chief Electoral Officer acknowledged that online voting may be coming, noting "online voting is something that's on the forefront of people's minds. . . people say, 'I can do my banking online, but I can't do my voting online'."

The enthusiasm for Internet voting is understandable. At first blush, there is a certain allure associated with the convenience of Internet voting, given the prospect of increased turnout, reduced costs, and quicker reporting of results.  Moreover, since other security sensitive activities such as banking and health care have gravitated online, supporters argue that elections can't be far behind.

Yet before rushing into Internet voting trials, the dangers should not be overlooked.

Democracy depends upon a fair, accurate, and transparent electoral process with outcomes that can be independently verified.  Conventional voting accomplishes many of these goals – private polling stations enable citizens to cast their votes anonymously, election day scrutineers offer independent oversight, and paper-based ballots provide a verifiable outcome that can be re-counted if necessary.

While technology may someday allow us to replicate these essential features online, many of them are currently absent from Internet voting, which is subject to any number of possible disruptions.  These include denial of service attacks that shut down the election process, counterfeit websites, phishing attacks, hacks into the election system, or the insertion of computer viruses that tamper with election results.

These concerns are based on real-world experience.  The Internet Corporation for Assigned Names and Numbers (ICANN), the organization that administers the domain name system, ran an online board of director election in 2000.  The experience was fraught with technical difficulties, leading a reviewer to conclude "the technical weakness in the registration system made it virtually impossible to assess the integrity of the voters' list, the security of the PINs, and secrecy of vote."

More recently, the Netherlands used Internet voting as part of its 2006 parliamentary elections.  The online option was an alternative for Dutch citizens working or living abroad.  Nearly 20,000 valid Internet votes were received at a cost of approximately 90 euros per Internet voter.  Two years later, the country implemented a ban on Internet voting.

The Canadian experience is limited primarily to municipal elections.  Several Ontario municipalities have offered Internet-based voting, enabling local residents to vote without leaving their homes.  Residents were required to pre-register for Internet voting and were provided with detailed instructions on the technical requirements to "vote anywhere."

Caution on Internet voting appears prudent, since experts have identified a long and costly list of necessary precautions, including random spot checks and post-vote verification programs to preserve anonymity.  Given the security risks, opening the door to provincial or federal Internet voting seems premature.  In the zeal to increase voter turnout, the reliance on Internet voting could inadvertently place the validity of the election process at risk.  

Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.