DESCRIPTION OF E-GOV 2.0 IMPLEMENTATION – e-voting Estonia

1. Implementation procedure

2. Implementation's characteristics

Electronic voting (I-voting) is one of the possibilities to vote in addition to other voting methods. I-voting means in this context voting via Internet, not voting by using a special voting device.

 

In 2012 a separate Electronic Voting Committee was established who is now responsible for conducting Internet voting while the National Election Committee retains a supervisory role. Internet voting was first introduced in the local elections of 2005, when more than 9 thousand voters cast their ballot via the Internet (this corresponded to about 2 per cent of all participating voters). Today, I-voting with binding results has been carried out seven times in Estonia: in the local elections in October 2005, the parliamentary elections in March 2007, the European Parliament elections in June 2009 and May 2014, the local elections in October 2009, the parliamentary elections in March 2011 and the local elections in October 2013.

 

The subject of e-voting has been actively discussed in Estonia on different levels since the beginning of this century. There exists an opportunity and motivation to implement such a project with the purpose of offering voters a possibility of e-voting at elections and referendums, for:

  1. There exists a legal basis for carrying out e-voting which is laid out in all legal

acts concerning elections,

  1. A public key infrastructure enabling secure electronic personal authentication

using digital signatures and ID-cards has been created – currently (September 2010) over 1,100,000 ID-cards have been issued, meaning that most of the eligible voters is covered.

This overview gives a general description of the technical and organizational system of the e-voting system. In this overview we:

  1. defines the scope of e-voting, in other words, defines the subject in the context
  2. of the election process as a whole,
  3. specifies the system requirements,
  4. specifies the participating parties of the system and describes their roles,
  5. specifies the architecture of the e-voting system, the general description of
  6. functionality, protocols and algorithms,
  7. analyses and describes possible security hazards and examines the compliance
  8. of the system to security requirements.
  9. This document discusses to some extent but does not concentrate on:
  10. exact specification of the security level of system components,
  11. specification of data structures,
  12. choice of software and hardware platforms,
  13. technical structure of the system’s network – server redundancy, network
  14. security measures to be used (firewalls, intrusion detection systems),
  15. architecture of network connections.
  16. Scope of E-voting System

The e-voting system to be discussed makes up a relatively small part of the whole

election process. From a technical viewpoint the elections are made up of the

following components:

  1. calling of elections,
  2. registration of candidates,
  3. preparation of polling list,
  4. voting (a subset of which is e-voting),
  5. counting of votes.

Other components such as auditing, reviewing of complaints and other supporting

activities could be mentioned.

The e-voting system discussed in this paper assumes that:

  1. voter lists have been prepared and are available in a suitable format,
  2. the candidate lists have been prepared and are available in a suitable format,
  3. e-votes are counted separately and are later added to the rest of the votes.

In other words the input of the e-voting system is made up from:

  1. voter lists (including the polling division and constituency assigned to the
  2. voter),
  3. candidate lists (by constituencies),
  4. expressed will of the voters,
  5. and the output is made up from:
  6. summarized voting result of e-voters,
  7. list of voters who used e-voting.

The following figure illustrates the scope of an e-voting system and its input and output parameters:

VotingProcedure

 

Basic Principles of E-voting

The main principle of e-voting is that it must be as similar to regular voting as possible, compliant with election legislation and principles and be at least as secure as regular voting. Therefore e-voting must be uniform and secret, only eligible persons must be allowed to (e-)vote, every voter should be able to cast only one vote, a voter must not be able to prove in favour of whom he/she voted. In addition to this the collecting of votes must be secure, reliable and accountable. According to Estonian election legislation e-voting takes place from 10th to 4th day before Election Day and the following requirements are laid out: “(1) On advance polling days, voters may vote electronically on the web page of the National Electoral Committee. A voter shall vote himself or herself. (2) A voter shall authenticate himself or herself on the basis of a certificate issued in terms of the Personal Identity Documents Act. (3) After identification of the voter, the consolidated list of candidates in the electoral district of the residence of the voter shall be displayed to the voter on the web page. (4) The voter shall select the name of the candidate in favour of whom he or she wishes to vote in the electoral district of his or her residence, and shall confirm the vote by giving a digital signature. (5) A notice that the vote has been taken into account shall be displayed to the voter on the web page. (6) The voter may change his or her electronically given vote: 1) by voting again electronically from 10th to 4th day before Election Day; 2) by voting with a ballot paper from the 6th to the 4th day before Election Day. The following principles are specific to e-voting:

 For voter identification ID-cards (and from 2011 Mobile-ID solution) is used

 

ID-card (and the Mobile-ID solution) are the only independent means of electronic communication that enable to authenticate voters at a maximum security level, enable to give digital signatures and that most of voters already possess. The last aspect is vital – in regards to Estonian e-voting, systems that require previous on-the-spot registration are not considered.

 Possibility of electronic re-vote – e-voter can cast his/her vote again and the previous vote will be deleted

 

Even though usually multiple voting is considered a crime (Penal Code, § 165), in this case it is a measure against vote-buying – the voter who was illegitimately influenced can cast the vote anew once the influence is gone. Electronic “re-vote” cannot thus be considered “multiple voting” as the system will only take into account one vote (the one given last).

 

Now we will specify the system components and describe their functionality and interfaces. We will determine the participating parties in the system and describe the possible breakdown of components between different parties. The following figure describes the system architecture:

VotingArchitecture

 

We will start by describing the parties which in the figure are represented by differently coloured squares:

  1. Voter – e-voter with his/her PC. Creates an encrypted and digitally signed vote and sends it to the Central System.
  2. Central System – System component that is under the responsibility of the National Electioral Committee. Receives and processes the votes until the composite results of e-voting are output.
  3. Key Management – Generates and manages the key pair(s) of the system. The public key (keys) are integrated into Voter’s applications, private key(s) are delivered to Vote Counting Application.
  4. Auditing – solves disputes and complaints, using logged information from the Central System.

The Central System is also dependent of two other parties:

  1. Compiler of voter lists (The Population Register),
  2. Compiler of candidate lists (NEC itself).

Now we will examine the components of the Central System:

  1. Vote Forwarding Server (VFS) – authenticates the voter with the means of ID-card, displays the candidates of voter’s constituency to the voter and receives the encrypted and digitally signed e-vote. The e-vote is immediately sent to the Vote Storage Server and the confirmation received from there is then forwarded to the voter. It ends its work after the close of advance polls.
  2. Vote Storage Server (VSS) – receives e-votes from the VFS and stores them. After the close of advance polls removes double votes, cancels the votes by ineligible voters and receives and processes e-vote cancellations. Finally it separates inner envelopes from outer envelopes and readies them for the Vote Counting Application.
  3. Vote Counting Application (VCA) – offline component to which encrypted votes are transmitted with the digital signatures removed. The Vote Counting Server uses the private key of the system, tabulates the votes and outputs the results of e-voting.

2015 number of Internet voters is 176491 at the elections of the Riigikogu.

 

 

  1. NAME OF WEBSITES / APPLICATION [in the primary language in which the service is provided]

As of 2013, the source code of the I-voting software has been made public at

https://github.com/vvk-ehk/evalimine.

  1. Website address:

https://www.valimised.ee/eng/

 

  1. Page / application implementation procedure:

Name of the organization leading website / application: [Enter the name in the primary language in which the site is provided]    

Electronic Voting Committee

The Electronic Voting Committee has been formed by the National Electoral Committee on December 7th 2012.

The legal regulation of the committee is drawn from the Riigikogu Election Act (mostly Art 17.1, Art 17.2, Chapt 7.1)

 

Head of the Committee: Tarvi Martens (tarvi.martens<at>vvk.ee)

Deputy Head of the Committee: Epp Maaten

Members: Uve Lokk, Hillar Aarelaid, Sven Heiberg, Tavo Toomemägi, Tanel Kuusk

 

The function of the Electronic Voting Committee is to prepare and organise electronic voting, to resolve any cases hindering electronic voting pursuant to law and to verify the results of electronic voting.

 

 

Type of institution leading website / application (please choose one item from the list):

– Governmental institution

 

Financing method:

– State funds

 

Application launching year: first release 2001

 

Application technology:

Debian Wheezy

Python, C++

CGI interfaces

Digital signature component

 

The popularity of the page / application: More than 100 million digital signatures have been made in Estonia since the system became available.

Screenshots along with a brief description:

 

 

 

  1. Characteristics of implementation:

 

Following are a number of issues and questions that have been solved when implementing the Estonian ID card and digital signature infrastructure.

Certificate profiles and e-mail addresses

The certificates on Estonian ID cards are standard X509v3 certificates. The authentication certificate contains the card holder’s e-mail address. The certificate profile is available in a separate document.

Certificate validity verification methods

According to Estonian DSA, CSP-s must provide “a method of verifying certificate validity online”. SK as the issuer of certificates to ID cards provides users three ways of checking certificate validity.

CRL-s are provided, containing the list of suspended and revoked certificates. CRL-s are standard but outdated method, because as of January 2003, CRL size has grown to over 1 MB in one year and it is not very convenient to use. CRL-s are mainly provided for backwards compatibility and standards compliance. SK updates its CRL twice a day. Delta CRL-s are not provided.

The second method is an LDAP directory, containing all valid certificates. The directory is updated in real time – if a certificate is activated, it is uploaded to the directory, and if it is suspended or revoked, it is removed from there. Among other things, this provides everyone a chance of finding the e-mail address of any ID card holder. Restrictions are in effect as to the maximum number of responses returned to one LDAP query to protect against server overload.

The most convenient method of verifying certificate validity is SK-s OCSP service. It can be used for simple certificate validity confirmations, but also for validity confirmations (“notary confirmations”) to digital signatures. SK provides a standard OCSP service compliant with RFC 2560. An important detail is that according to the RFC, OCSP responses are supposed to be based on CRL-s and therefore may not necessarily reflect the actual certificate status. In contrast, SK has implemented its OCSP service in such a way that it operates directly off its master CA certificate database and does not use CRL-s. Thus, SK-s OCSP responses reflect actual (real-time) certificate status. In terms of the RFC, the response’s thisUpdate and producedAt fields are equivalent.

OCSP, time-stamping and evidentiary value of digital signatures

For legally binding digital signatures, time is an extremely important factor. According to the Estonian DSA as well as common sense, only signatures given using a valid certificate are to be considered valid. On the other hand, to provide remedy to the risk that the signing device (ID card) may be stolen together with PIN-s and digital signatures could be given on behalf of the user by someone else, users have the chance of suspending their certificate validity using a 24-hour telephone hotline operated by SK. With these two concepts combined, users must be able to clearly differentiate the signatures given using a valid certificate from those given using a suspended or revoked certificate. Thus, there is a need for a time-stamping and validity confirmation service which binds the signature, time and certificate validity.

Another important concept concerning signature validity is that the signature must be valid also when the certificate has already expired or been revoked. If a certificate is suspended by the card holder or anyone else, the card holder can reactivate it at a bank office.

A number of experimental time-stamping protocols and technologies have been proposed, but no common understanding or agreements of time-stamping is present, the experimental technologies are under constant development and not in mass use. Thus, an innovative approach was needed. SK chose to base its time-stamping implementation on standard OCSP. The protocol contains a Nonce field, which protects against replay attacks. Instead of cryptographically random data, the Nonce field is set to contain the hash of the data to be signed, because it can also be interpreted as just a random number. According to the RFC, the OCSP responder signs its response which in SK-s case, contains the original nonce (document hash), response providing/signing time and ID of the certificate used to give the signature, binding the three pieces of data together and providing the validity confirmation for the digital signature. SK stores the signed response in its log as evidence material.

2015 Number of Internet voters is 176491

References

  1. Reports and Statistics about Internet Voting in Estonia http://www.vvk.ee/index.php?id=11509 retrieved 06.03.2015

3. Detailed description categories

Service's/Application's integration to social networking sites
  • Yes
Is the connection encrypted?
  • Yes

4. Service's/Application's integration with social networking sites

As for:
The project hasn't its profiles on networking sites:

5. Screen gallery