Report to: General Committee Date Report Authored: April 23, 2010
SUBJECT: Approval of Alternative Voting Methods - 2010 Municipal Election
PREPARED BY: Andrew Brouwer, Deputy Clerk, Ext. 8220
RECOMMENDATION:
1. That the Report entitled “Approval of Alternative Voting Methods - 2010 Municipal Election” be received; and,
2. That Council adopt the by-law attached as Appendix “A” to authorize the use of Optical Scan Vote Tabulators and Vote Recorders for the 2010 Municipal Elections; and
3. That Council adopt the by-law attached as Appendix “B” to authorize the use of Internet Voting for the Early Voting Period for the 2010 Municipal Elections; and further,
4. That staff be authorized to give effect to this resolution.
PURPOSE:
The purpose of this report is to obtain Council’s approval for the use of optical scan vote tabulators for the 2010 Municipal Election and to seek Council’s approval for the use of internet voting during the Early Voting Period for the 2010 Municipal Election.
BACKGROUND:
Section 42(1) of the Municipal Elections Act, 1996 (
At the
Based on the positive outcome of the review process, staff recommend Council proceed with the use of optical scan vote tabulators for the 2010 Municipal Election and with online voting for the Early Voting Period.
OPTIONS/DISCUSSION:
Optical Scan Vote Tabulators
Markham has successfully utilized optical scan vote tabulating equipment
for the past several electoral events. Most municipalities in the Greater Toronto
Area use optical scan vote tabulating equipment. The tabulators provide an accurate count of the
votes and facilitate the rapid return of election results on Election Night. In the 2006 Municipal Election and recent Ward
3 By-Election, the Town used an automated ballot marking device equipped with
various appliances (e.g., paddles and sip/puff indicators) to allow individuals
with reduced vision, hearing or mobility to vote independently. Once a ballot has been marked using the
device, ballots are fed through an optical scan vote tabulator to be counted. Accessible equipment such as the automated
ballot marking device supports the Town’s corporate accessibility goals and newly
established
Internet Voting
To staff’s knowledge, voting systems
resulting in a “virtual vote” (internet and telephone voting) have been used in
more than 35 municipalities in
As indicated, a comprehensive review of election
platform proposals included a number of standards around security,
accessibility and functionality. The
recommended vendor was successful in meeting or exceeding these standards,
which are quite varied and comprehensive and speak to security from a variety
of perspectives and steps in the election process. To help further inform staff’s
recommendations, York University Associate Professor of Information Systems and
Management Science, Dr.
Some concerns related to the
“unsupervised” nature of internet voting have been raised. Internet voting is an unsupervised form of
voting, similar to telephone and vote-by-mail currently deployed by at least 150
To assist in maintaining the integrity of
the electoral process in an unsupervised voting environment, the
· Interfere or attempt to interfere with an elector who is marking the ballot;
· Obtain or attempt to obtain, at a voting place, information about how an elector intends to vote or has voted; or
· Communicate any information obtained at a voting place about how an elector intends to vote or has voted.
It should be understood that the
potential for illegal activity exists with any voting system. Internet voting procedures adopted in
The Town will continue to review and
investigate any concerns raised in relation to the security of its internet
voting platform and should there be sufficient evidence presented of a
violation of the
Following the Monday, May 10, 2010
General Committee meeting, Legislative Services staff will facilitate an
education and training session to specifically outline the selected platform’s
security, accessibility and functionality provisions and provide a forum for
further discussion. Dr. Kim has been
invited to provide an overview of his research.
Council adoption of the authorizing by-laws for the use of optical scan
vote tabulators and approval of the recommended election platform vendor will
not occur until the
Recently,
Staff recommend that the Council
authorize the use of internet voting for the Early Voting Period from October
16 to
FINANCIAL CONSIDERATIONS
Not applicable.
HUMAN RESOURCES CONSIDERATIONS
Not applicable.
ALIGNMENT WITH STRATEGIC PRIORITIES:
Not applicable.
BUSINESS
UNITS CONSULTED AND AFFECTED:
Not applicable.
Appendix “A”: A by-law to authorize the use of Optical Scan Vote Tabulators and Vote Recorders for the 2010 Municipal Elections
Appendix “B”: A by-law to authorize the use of Internet Voting for the Early Voting Period for the 2010 Municipal Elections
Appendix “C”: A Study of Internet Voting
Q:\
APPENDIX “A”
BY-LAW
2010-XXX
A By-law to Authorize the Use of Optical Scanning Vote Tabulators and Vote Recorders as an Alternative Voting Method
WHEREAS section 42 of the Municipal Elections Act, S.O. 1996 provides that a municipal council may enact a by-law authorizing the use of voting and vote counting equipment such as voting machines, voting recorders or optical scanning vote tabulators on or before June 1 in the year of the election;
The use of Optical Scanning Vote Tabulators and Vote Recorders is hereby authorized for the purpose of counting votes at the 2010 Municipal Elections.
READ A FIRST, SECOND,
XXTH
________________________________ _____________________________
CLERK MAYOR
APPENDIX “B”
BY-LAW
2010-XXX
A By-law to Authorize the Use of Internet Voting as an Alternative Voting Method
WHEREAS section 42 of the Municipal Elections Act, S.O. 1996 provides that a municipal council may enact a by-law, authorizing the use of voting and vote counting equipment such as voting machines, voting recorders or optical scanning vote tabulators and other voting methods that does not require electors to attend at a voting place in order to vote, on or before June 1 in the year of the election;
NOW THEREFORE, the Council of the
Corporation of the Town of
The use of Internet voting is hereby authorized for the purpose of voting during the Early Vote period for the 2010 Municipal Elections.
]
READ A FIRST, SECOND, AND THIRD TIME AND PASSED THIS
XXTH
________________________________ _____________________________
CLERK MAYOR
APPENDIX “C”
E-Mergent Management Research
A Study of Internet Voting Security Risks and
Accessibility Opportunities for the Town of
A Study Prepared
for the Returning Officer, Town of
Executive Summary
In this study, we offer a perspective on the
risks for the Town of
The following highlights our perspective on
designing the
· Auditability
o Working with the vendor, the Town should establish procedures to demonstrate an audit trail for internet votes. We especially recommend independent tests be conducted by the vendor and the Town to demonstrate that what is digitally recorded (and printed, if need be) during the 2010 Municipal Election will be in fact what the voter voted.
· Security
o The vendor should have the latest tools and techniques for detecting internet attack attempts. These should be thoroughly documented.
o One of the most powerful and subtle deterrents against attacks on the election is the fact that such activities are indeed criminal offences punishable in the jurisdiction where they occur. This message should be conveyed clearly to internet voters. For the special case where apparent, even inadvertent coercion may result due to language difficulties, the Town should consider translating verbiage about what is/is not coercion in different languages.
o However, outsider hackers and foreign agencies are not subject to that deterrent. Working with the vendor, the Town should be able to identify and analyze in real-time anomalous accesses (especially from non-local sources) to voting servers and anomalous voting patterns.
· Voter rights
o Voters should be made aware of the criminal implications of acts like coercion, intimidation, vote selling, bidding, and switching that corrupt their voting rights.
o For the special case where apparent coercion may result due to language difficulties, the Town should consider translating notes about what is and is not coercion in different languages. Again this could be in paper material or on the municipal website.
· Recoverability
o Working with the vendor, the Town should document a recovery procedure. The procedure should address questions like, “Given that a known or even an unknown threat has materialized, what are the steps to ‘recover’ the integrity of the 2010 Municipal Election.
We believe that
Finally many have expressed concern that
internet voting will obviate or perturb the extemporaneous “water cooler”
networking that happens around voting places. Such networking activities serve
a subtle but useful role in the voting process, and it is not clear what effect
internet voting will have. We posit that the positive effects of what is
effectively a Voting Day social networking event all over the Town could be
mimicked or complemented by an evolving social networking community online
within which voters and campaigners interact before, during, and after an
election. Internet voting would represent the cornerstone piece for building
such a community. By virtue of its internet voting advantages,
Summary of Findings
In November 2006, the Town of
Prior to the 2006 elections, we conducted a risk
analysis of different remote voting modes: 1) Traditional voting place voting
only (with advanced voting); 2) 1 step internet voting + traditional voting; 3)
2 step internet voting + traditional voting; and 4) mail-in only. After
quantifying risk profiles, it was concluded that the 2 step internet voting +
traditional voting represented the lowest risk profile next to the traditional
voting place only alternative. A noteworthy product of the analysis was the
conclusion that that internet voting mode represented a lower risk profile than
the mail-in only mode, a mode whose risk profile most in the elections
community are generally comfortable with. Given findings like this, it was
recommended that
After two successful iterations,
Below, we outline some recommendations based on
our examination of the literature and applying it to the
Auditability
·
It is recalled that the City of
· The vendor should be able to “make real” virtual objects. For example, the vendor should be able to print a completed paper ballot for each online vote, if need be. Or, it should be possible to print off master lists. Though this capability may seem superfluous, the majority of citizens (which aptly characterizes major Town stakeholders) are comforted knowing that they would be able to “see, touch and feel” artifacts like completed ballots, which they intimately associate with voting.
· The voter should be given the option to print the screen, which shows their voting choice. The printout would serve as verification for the voter, and represents a subtle means to make the vote more concrete. It may be possible to even solicit these ballots using a statistical sampling plan if a post-election audit is called. Obviously, the procedure for doing this must be weighed and carefully documented.
·
Security
· The vendor should have the latest tools and techniques for detecting internet attack attempts. These should be thoroughly documented. It is desirable that the documentation should show each type of potential attack, how the system would recognize them, and then how the system will counter that attack.
· The vendor should have techniques to prevent and correct for pharming and man-in-the-middle attacks. In addition, the vendor should specify how successful attacks of these sorts, when conducted in small-scale (i.e. affects a limited number of votes), can be remediated.
·
One of the most powerful, and
subtle, deterrents against attacks on the election is that such activities are
criminal offences punishable in the jurisdiction where they occur. However,
outsider hackers and foreign agencies are not subject to that deterrent.
Relative to, say, the
·
A usable proxy that outsiders
may have an insidious interest in
· There should be documented procedures between the IT staff at the Town and the vendor to identify, communicate, and analyze anomalous internet voting occurrences.
Voter Rights
· Either in the paper material that is sent to potential internet voters or even on municipal websites in which they vote, voters should be made aware of the criminal implications of acts like coercion, intimidation, vote selling, bidding, and switching that corrupt their voting rights.
· For the special case where apparent coercion may result due to language difficulties, the Town should consider translating information about what is and is not coercion in different languages. Again this could be in paper material or on the Websites.
· If not already in their standard procedures, the Town should conduct some usability tests. This is especially important if the user interfaces provided by the vendor differ substantially from those of the 2003 and 2006 elections, and if additional information (different from 2003 and 2006) needs to be presented to the voters. In particular, ways to make the task of voting easier and more seamless once the potential internet voter has received their password should be explored. In addition, usability testing should also be extended to examine all paper documentation that voters receive—e.g. is it easy to find the directions, or how should alternate language instructions be presented.
Recoverability
·
The Town and the vendor should
work together to document recovery procedures. Given that a known or even an
unknown threat has materialized, what are the steps to “recover” the integrity
of the election? What is the line between some threat that can be contained in
small-scale (i.e. some voters are requested to re-vote online or vote at the
polls) or an attack that requires voiding all online voting? How will that
decision be made? How will online voters be made aware? These are some of the
issues that need to be addressed and documented. It is recognized that
practically, not everything needs to be documented; a key role of elections
officials after all is to effectively deal with ad hoc situations.
However, recall that the public has a heightened sense of security risk
pertaining to internet voting, and for rare events like a successful attack of
online voting, knowing how to deal with attack consequences is more important
than prevention.
· In general, the vendor should specify the delineation between a successful attack that can be corrected for in small-scale, versus a successful attack that is considered large-scale, and may prompt voiding of all or some part of internet voting.
Inasmuch as
Careful examination of the literature on internet voting as well as the pilot experiences of many jurisdictions suggests that both the extremely optimistic and pessimistic positions about the effects of internet voting are overstated. Internet voting will not act as a panacea for the social causes responsible for electoral disengagement, nor will it remedy negative attitudes toward political entities. It will, however, increase voting opportunities for electors and make casting a vote more accessible. On the other side, Internet voting will not erode democracy or result in vote buying and election fraud any more than does the existing system.
There are numerous security risks of internet voting, many due to vulnerabilities inherent in internet use. Many have outlined that these risks cannot be completely eliminated. In our opinion, security risks are mitigated by 3 factors favourable to the Town:
1. Prior experience: The Town has accumulated expertise, documentation, and lessons-learned from conducting internet voting twice before. The Town has experienced normal turnover both at the IT staff level and in election staff since the 2006 Municipal Elections. Nevertheless, we believe the collective expertise on internet voting remains within the Town. Hence, it is well prepared to choose the most appropriate vendor with whom to partner to develop the IT systems, processes, and procedures for internet voting in 2010.
2.
Recoverability: In our 2006 analysis, we quantified 45 threats to internet voting.
Some were due to remote hackers and other IS related origins, but many were
threats faced regardless of mode of voting. For internet voting, the two step
process (rather than one step), and security features applied by the vendor and
the Town largely mitigated, but not completely eliminated, the risks. Even if
vulnerabilities were successfully exploited in large scale,
3.
Limited Visibility: In our 2006 analysis, we surmised that the most likely
vulnerabilities to be successfully exploited would be at a small scale—e.g.
inadvertent mishaps or dubious voters at one location—and more likely to happen
at voting places than over internet voting. Elections officials know how to
deal with threats like these. However of greater concern are the hackers from
some distant land. We pegged the probability of a success attack as extremely
low. Nevertheless, leveraging the efficiency of internet use, they can inflict
large scale damage, elections officials are not accustomed to dealing with
these threats. Further, applicable
deterrents, say, to a
On the other side, there are five factors
that give
1.
Markham’s Demographics: According to literature, the demographic of the likeliest internet
voter is characterized as relatively more comfortable with technology, more
affluent, more educated and younger than the demographic for the most active
voters [Caporusso,
Buzzi, Fele, Peri, Sartori, & di Sociologia 2006; Reniu 2005]. The median age in Markham is 38.1, which is below the provincial
median of 39 [Town
of Markham 2009], and
Ontario has the lowest median age of any province. In addition, the percentage
of the population over 65 in
2.
Lack of Election
Contentiousness: There is literature that states
that internet voting and other convenience voting options (e.g. mail-in voting)
have a statistically significant impact on overall voter turnout in
lowly-contested or non-contentious elections [Gronke,
Galanes-Rosenbaum, Miller, & Toffey 2008]. In these cases, many who would have participated in
heavier-contested elections just don’t get as engaged. In these situations,
internet voting may be the difference between getting these folks to vote or
not. This is not to categorically imply that
3.
Accessibility to seniors, disabled,
and non-English speakers: “Digital Divide” refers
to the gulf that exists between those who have widespread, convenient access to
the internet and those who don’t. The “haves” are more affluent, better
educated, and younger. In addition, in Canada, people in urban areas have much
greater access than those in rural areas [Sawada,
Cossette, Wellar, & Kurt 2006]. Clearly between
Interestingly, the
most likely beneficiaries of increased voting accessibility are seniors.
Inasmuch as they as a group end up on the “have-not” side of the digital
divide, they are also very willing to vote, and willing to vote online. To illustrate,
Internet voting
would seem to be extremely convenient for the disabled, but beyond conjecture,
there is little in the way of research about this topic. As well, there is
little research about internet voting for non-English speaking voters. This is
pertinent for
As a municipality,
4.
Prior Experience – Town
Officials’ Perspective: By the end of 2010,
5.
Prior Experience –
Candidates’ Perspective: internet voting has
perturbed campaigning [Goodman,
Pammett, & DeBardeleben 2009]. In
We believe that
In our opinion, the challenge for subsequent internet voting instances is to build from what has been achieved. Halifax serves as an example [Goodman, Pammett, & DeBardeleben 2009]:
[C]andidates were able to keep track of supporters during campaign timelines using an internet candidate module. This allowed for the generation of multiple support lists such as a special list of undecided voters or categorization by area (i.e. street), which was a useful vehicle for mobilization. It also reduced the need for the traditional candidates’ representative function because parties were able to track participation on-line.
Internet voting served as a driver for re-thinking and improving campaigning and canvassing strategies. There are other complementary innovations that use IT and the internet to enrich the relationship between candidates and voters. For example, through the Smartvote Website, Swiss municipal politicians fill out questionnaires that collect their positions on issues weeks prior to an election. Potential voters can then match their views on issues with those of the politicians, and even analyze and visualize politicians’ positions [Thurman & Gasser 2009]. Also, the politicians are able to post their positions and other news and update their postings.
In traditional
voting, there are few contact points between candidates and their constituents.
Certainly the vote itself is one; a conversation while canvassing is another. A
website mediates, enriches, and keeps persistent a personalizable (as
opposed to a generic sign on the neighbour’s lawn) dialogue between the
candidates and their constituents. Businesses right now are exploring
strategies to maintain dialogue with their customers and they are finding that
social media—blogs, Wikis, Facebook, LinkedIn, and social bookmarking
sites—provide them this opportunity. Blogs and social media groups are now
heavily put to use by politicians in US,
[I]n a dynamic social and technological
environment inaction can have negative consequences. If cultures of shopping,
banking, playing games and socialising are increasingly moving online, the
failure of the political sphere to move in tandem risks confining it to
eccentric marginality. This might be the strongest argument for voting online:
the symbolic message is delivered that democracy is consistent with
contemporary culture. The risk of such symbolism for the political elite – and
a democratic opportunity for citizens – is that online voting will stimulate a
public appetite for a more interactive system of representation before and
after elections. [Coleman 2005]
Introduction
Voting is a fundamental right and privilege of democracy. When this privilege is not exercised, one reason may be that being at a voting station during certain hours in a given day may not be feasible or inconvenient for many. Even though it seems reasonable that providing more convenient ways to vote may increase voter participation, the following statistic is nevertheless surprising.
37% of voters cast their ballots before
Voting Day [of the
In the highest profile election in the world, more than ⅓ of the voters chose methods that gave them the convenience to vote irrespective of time and distance! Of course, the internet enables transcending time and distance. Ostensibly then, internet voting is the perfect union between the convenience and accessibility that voters seek with the ubiquitous infrastructure upon which votes can be cast cost-effectively and efficiently.
Beyond efficiency and convenience, there is an even more compelling argument for internet voting.
[I]n a dynamic social and technological
environment inaction can have negative consequences. If cultures of shopping,
banking, playing games and socialising are increasingly moving online, the
failure of the political sphere to move in tandem risks confining it to
eccentric marginality. This might be the strongest argument for voting online:
the symbolic message is delivered that democracy is consistent with
contemporary culture. The risk of such symbolism for the political elite – and
a democratic opportunity for citizens – is that online voting will stimulate a
public appetite for a more interactive system of representation before and
after elections. [Coleman 2005]
Alas, internet use has drawbacks, mainly security concerns.
The real barrier to success is not
a lack of vision, skill, resources, or dedication; it is the fact that, given
the current Internet and PC security technology, and the goal of a secure,
all-electronic remote voting system, the [US Department of Defense] has
essentially taken upon an impossible task [to meet that goal]. (Jefferson et al. 2004)
Given this, why should the Town of
This study addresses that important question. It especially reports on the state of the art in thought leadership and technologies regarding internet voting and the assessment of its risks. It also draws from authoritative sources to comment on the concomitant “Internet voting as a cornerstone platform for e-democracy” vs. “Internet voting as a security and privacy threat” trade-off debate.
To be sure, internet voting is vulnerable to threats. However, threats like these are often more susceptible to perception than to likelihood of occurrence.
Social aspects of security of information systems are often discussed in terms of “actual security” and “perceived security.” This may lead to the hypothesis that e-voting is controversial because in paper voting, actual and perceived security coincide, whereas they do not in electronic systems. [Pieters 2006]
A gray swan [as opposed to a black
swan] is a large-impact and rare event that is somewhat predictable, but
overlooked by major stakeholders… Examples of negative gray swans are
hurricanes, earthquakes, US sub-prime crisis, and DDoS (Distributed Denial of
Service) attack on
These two excerpts illustrate the challenges in assessing risks of internet voting. For public officials and the general public, internet voting represents something unknown. People tend to embellish its risks due to their inherent cognitive difficulty in dealing with uncertainty. The perception of risk is further heightened because of historical rarity of internet voting mishaps; a successful execution of an internet voting threat can be considered a gray swan event because it really hasn’t happened on a large-scale, resulting in a large impact. Colloquially, it can be said that risks of internet voting are unknown (actual and perceived security do not coincide) and unknowable (gray swan).
Yet, the second excerpt provides what is
arguably the overarching principle for assuring the integrity of internet
voting: focus on consequences of any negative gray swan event, be it a
malicious attack from an insider or a hacker, or a chain of unanticipated
software/hardware failures. Exactly along this vein, in 2003 and 2006,
Internet Voting: Security Risks
In 2004, a group of researchers analyzed the
risks and vulnerabilities of SERVE, a system developed experimentally by the US
Department of Defense [Jefferson,
Rubin, Simons, & Wagner 2004]. The end-goal of SERVE was to provide overseas
Elections officials at the Town have made compelling arguments for conducting internet voting for the Town based on factors such as lowered costs in present and future elections of having fewer voting palces and personnel, reduced carbon footprint of ballots and other papers, accessibility, and contribution to the branding of Markham as innovative and technologically-savvy. We assume for this study that the pros outweigh the cons. However to maintain recoverability in the face of the legitimate concerns raised by analyzers of SERVE, the Town should be mindful of the following:
·
It is recalled that the City of
· The vendors should have the latest tools and techniques for detecting internet attack attempts. These should be thoroughly documented. It is desirable that the documentation should show each type of potential attack, how the system would recognize them, and then how the system will counter that attack.
· The Town and the vendor should work together to document recovery procedures. Given that a known or even an unknown threat has materialized, what are the steps to “recover” the integrity of the election? What is the line between some threat that can be contained in small-scale (i.e. some voters are requested to re-vote online or vote at the polls) or an attack that requires voiding all online voting? How will that decision be made? How will online voters be made aware? These are some of the issues that need to be addressed and documented. It is recognized that practically, not everything needs to be documented; a key role of elections officials after all is to effectively deal with ad hoc situations. However, recall that the public has a heightened sense of security risk pertaining to internet voting, and for gray swan events like a successful attack of online voting, knowing how to deal with attack consequences is more important than prevention. The Town has developed very good procedures and processes for internet voting, so it is not anticipated that there should be many refinements to those procedures and processes. It is recommended however that the Town consider documentation of internet voting recovery procedures as one of these refinements.
·
Those who examined SERVE were
especially wary of the high-profile, high-impact nature of the
Similar conclusions as SERVE’s analyzers are
drawn by [Enguehard
& Lehn 2009]. Much
like
·
The implication for
· In general, the vendor should specify the delineation between a successful attack that can be corrected for in small-scale, versus a successful attack that is considered large-scale, and may prompt voiding of all or some part of internet voting.
Finally,
Internet voting radicalises the automation process by handling dematerialised objects. The voting process is displaced from the real world to a virtual world where the observations made directly through our perceptions (sight, touch, etc..) do not apply and which is outside the reach of the majority of citizens. [Enguehard & Lehn 2009].”
Having stated this, perhaps the majority of the citizens can be “reached” if the difference between the actual and the virtual can be narrowed, thus narrowing the gap between perceived and actual security of internet voting.
· The vendor should be able to “make real” virtual objects. For example, the vendor should be able to print a completed paper ballot for each online vote, if need be. Or, it should be possible to print off master lists. Though this capability may seem needless, majority of citizens are comforted knowing that they would be able to “see, touch and feel” artifacts like completed ballots, which they intimately associate with voting.
It is important to reiterate that the concerns raised by [Jefferson, Rubin, Simons, & Wagner 2004] and [Enguehard & Lehn 2009] about internet voting are based on the assumption of a one-step internet vote. Though hacker risks cannot be eliminated entirely, using a two-step method considerably mitigates the risk of hacker threats like pharming and man-in-the-middle. Moreover, “proponents of online voting claim that the risks have been exaggerated and that such panics follow most technological innovations” [Coleman 2005].
Ultimately, the concept of e-government is truly credible only when it supports online voting. But it’s important to note that internet voting need not be a “black and white” issue [Coleman 2005].
In the polarised debate about online voting, risk tends to be presented as if online elections will either be ruinous to, or panaceas for, existing problems of democracy. In reality, most successful processes operate on the basis of low risk rather than no risk. Managing risks is more achievable than seeking to eliminate them.
Opponents of online voting
sometimes depict existing electoral practices as being risk-free. In fact, fraudulence
has always existed to some extent in paper-ballot elections; in
As with other areas in which risks need to be explained or discussed with the public, communication should be characterised by openness and credibility… In the case of online voting, this entails recognition of the fact that some risks are greater and more intractable than others and that, because all activity is potentially hazardous, it is necessary to think in terms of trade-offs rather than risk-free ends. Instead of a polarised debate between technophiles and luddites, perhaps online voting requires a more mature public debate about the level of risk that is acceptable in modernising elections.”
Where does that trade-off lie? Simplistically, we offer our opinion that if an election is sufficiently high-profile and high-impact, that trade-off point may be neared.
·
It seems abstract to somehow
associate the extent to which an election can be considered high profile, and
high impact to online voting. A usable proxy may be the locales of IP addresses
attributed to votes cast. In the two-step mode, the voter must receive two
separate pieces of mail on different dates at their home address. Also
· There should be documented procedures between the IT staff at the Town and the vendor to identify, communicate, and analyze anomalous internet voting occurrences.
There are additional technical issues [Ballas 2006] that the vendor must resolve. Voter authenticity requires that only eligible voters who have passed through the two-step process may vote online. As previous mentioned, attacks like man-in-the-middle threaten voter authenticity, but there is a caveat to this risk [Ballas 2006]: “Such a threat is significant and possible in major elections (e.g. US presidential election) due to its high popularity as a target of attacks, but it is argued that it is not a particular threat in smaller elections where the stakes and spread of the voters is different” [Mohen & Glidden 2001]. System accountability means that the vendor is accountable for identifying and correcting system malfunctions and manipulation attempts in a timely manner. System availability means that the internet voting system should be online when a voter wants to vote. Internet threats like Denial of Service (DoS) attacks as well as non-malicious issues like malfunctions and other mishaps can threaten system availability. The previously-stated notion of recoverability as well as providing many dates for internet voting largely mitigate this risk, although the loss of popular support may result if downtime ends up being substantial.
Another issue, system disclosability refers to the transparency of hardware and software for third party verification. The innards of a vendor’s systems like programmatic code and technical specifications constitute the vendor’s intellectual property. Not surprisingly then, these details are not disclosed, and hence many argue that it is not possible to sufficiently scrutinize internet voting. Proponents of “open source” software in which the programmatic code is available for scrutiny tout it as a fix for system disclosability since increased scrutiny should incentivize the vendors to write better software; its opponents say that the only useful open source software already form the basis of vendors’ software anyway.
The true remedy for system disclosability lies in due diligence. The vendors must exercise due diligence in delivering a reliable, quality product that can compete in a competitive environment for internet voting systems. And Markham must exercise due diligence in systematically selecting a vendor, whose systems the Town can trust even if it may not be able to openly verify it.
From our past work with
Internet Voting: Accessibility and Participation Opportunities
Threats on voter authenticity, system accountability, system availability, and system disclosability highlight the preoccupation with the technical aspects of internet voting systems: opponents point to the inherent security flaws in internet use, and proponents tout the security features of internet voting systems. Yet, some of the most challenging issues are those that are more social.
A final key issue falls under an umbrella term
of voter rights. These rights include privacy as well as the right to vote
without coercion. There are also limits on what the voter can do, namely the
prohibition on vote selling, bidding, and switching. What is challenging about
this issue is that unlike, say, voter authenticity, solutions cannot be readily
technically engineered (e.g. hacker checking) nor addressed through procedures
within
In terms of privacy, there lies an inherent conundrum. Ideally, it would be possible to audit and verify that the online vote was cast, collected, recorded, and stored accurately, and reflected the intent of the voter, without accessing information that could identify the voter. To use another example, note what is required to reverse an inadvertent financial transaction. A paper or otherwise auditable trail must be followed until the identity of the parties in the transaction as well as the details of the transaction can be verified. Auditing in this example is much easier because it is not constrained by the requirement to protect privacy, which is a fundamental voter right.
Some have proposed involving a fourth party,
separate from the Town, the vendor’s system, and the voter [Jones
2004]. This fourth party would
be responsible for independently addressing internet voting measures to ensure
voter authenticity, system accountability, system availability, and system
disclosability. This party would also audit results for anomalies. Most of this
would be redundant, but done at arms length from other parties with a “fresh
set of eyes.” However this is overly cumbersome, and would be quite expensive.
Perhaps for other larger scope elections, this form of redundancy may be
considered, but for
There are procedures that take the notion of an
independent party’s fresh set of eyes to strengthen auditing without
endangering privacy by giving additional responsibility to the voter. [Jones
2004] lists such procedures,
which
· The voter is given the option to print the screen, which shows their voting choice. The printout serves as verification for the voter, and represents a subtle means to make the vote more concrete. It may be possible to even solicit these ballots using a statistical sampling plan if an after-election audit is called. Obviously, the procedure for doing this must be weighed and carefully documented. On the other side, some argue that the voter should never hold a tangible record of their completed ballot [Enguehard 2008].
·
Social engineering is a term from Information Systems security parlance. Wikipedia defines it as “the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical hacking techniques (essentially a fancier, more technical way of lying).” An infamous hacker, Kevin Mitnick, stated it was much easier to trick someone into giving a password than hacking into a system. Vote selling, bidding, and switching are forms of social engineering, and as such it is easier for the perpetrator to do, and difficult to catch and design for. However as much as these acts may be do-able in a small scale, these acts are difficult to do in large scale; for example, a mass email soliciting votes would raise suspicion. So large scale damage of these acts is quite limited, and the risk of perpetrating these acts for internet voting is arguably no different than for traditional voting. Moreover, threats perpetrated in small-scale tend also to be geographically localized—e.g. buying votes from one’s neighbours and friends. As such, the threat of getting caught, punished, and ostracized by the local community is more compelling than for a hacker somewhere far away. So laws should act as deterrents against these acts.
Coercion also falls in the same category, with
the additional caveat that some acts that are technically coercion by law are
viewed by coercing and coerced parties as not inappropriate, never mind
criminal. In any municipality in the
· Either in the paper material that is sent to potential internet voters or even on the website in which they vote, voters should be made aware of the criminal implications of acts like coercion, intimidation, vote selling, bidding, and switching that corrupt their voting rights.
·
For the special case where
apparent coercion may result due to language difficulties,
Encompassing a social perspective to internet voting allows us to expand beyond technical impediments and discuss possibilities. Recall that internet voting is a form of convenience voting that happens to use the internet. And people definitely like the convenience: not only was the percentage of convenience voting in the US federal elections 37% in 2008, it steadily increased from estimates of 14% in 2000 [Gronke 2004], and 20% in 2004 [Gronke & Toffey 2007]. What follows is a discussion of effects when people are free to vote irrespective of time and geography [Gronke, Galanes-Rosenbaum, Miller, & Toffey 2008]. These effects must be compelling enough to make the assumption of internet voting risks worthwhile.
These results generally refer to the broad
category of convenience voting—which encompasses mail-in and advanced voting as
well as internet voting. Though the questionnaire results from 2003 and 2006
elections are very helpful, there is not nearly enough data for broader
inference from the
Will the Town’s use of internet voting indeed raise participation, and will it change the composition of voters? Will some constituents be more inclined to vote because the internet option is available? Will there be some constituents whose participation will be unaffected [Gronke, Galanes-Rosenbaum, Miller, & Toffey 2008]?
Not surprisingly, the public response has led many politicians to claim that convenience voting increases turnout. Political science research is substantially more skeptical. Voters decide whether to vote before they decide how to vote.
Having said that, there is something very pertinent to Markham, which jibes with the results of the post-election questionnaire results [Gronke, Galanes-Rosenbaum, Miller, & Toffey 2008]:
Some suggestive evidence, but not many empirical results, shows that voters use convenience voting procedures differently across election contexts—in particular, that the impact of convenience reforms is greater in lower-intensity contests. In general, the research concludes that convenience voting has a small but statistically significant impact on turnout, with most estimates of the increase in the 2%–4% range.
In
[D]emographic differences raise an important question for politicians who have to vote on legislation mandating new convenience voting methods: Do they help or hurt my political party and my own chances at reelection? Political science research has examined the partisan consequences of convenience voting reforms and found that political leaders have little to be concerned about.
These studies all suggest the same pattern: Voters who use convenience voting are more politically aware, more partisan, and more ideologically extreme.
Convenience voting does not appear to provide an advantage towards any political inclination. It may however reward the better-organized [Gronke, Galanes-Rosenbaum, Miller, & Toffey 2008].
Convenience voting reforms disrupt the timing and flow of elections. Campaigns must adjust to new laws and create strategies that maximize the new opportunities that early voting creates.
At the most basic level, allowing
voters to cast ballots before Election Day extends the “final push” of
mobilization back several weeks, raising the costs of campaigns’ “get out the
vote” efforts. [Gronke 2004]
On the other hand, it is possible
that convenience voting may actually result in more efficient campaigning.
Convenience voting provides campaigns with the opportunity to direct their
resources and efforts in a more strategic manner. Many states with significant numbers of absentee ballots publish which
voters have turned in their ballots prior to Election Day, creating a real-time
public record of who has and who has not voted. This could enable campaigns to
mobilize core supporters early by calling those who have not already voted and
then turning their efforts to undecided swing voters.
In fact in the recent Halifax elections, candidates were able to track who had already voted online, which had led to a decrease in crowding by candidates’ representatives at the physical voting places [Goodman, Pammett, & DeBardeleben 2009].
On one hand, circumspection is required in discussing the main touted benefits of convenience voting: increased voter participation and cost reduction.
In summary, convenience voting
lowers the cost of turnout, but unequally across different groups in the
population. Contrary to expectations that convenience voting reforms would dramatically
increase turnout, most estimates are that these reforms have, at best, a
marginal, though statistically significant, impact on voter participation. [Traugott 2003]
No academic studies that we are aware of have taken up the question of the costs of elections with convenience voting. The costs of elections has been referred to as the “holy grail” of election administration research because so little is known about the subject. [Gronke, Galanes-Rosenbaum, Miller, & Toffey 2008]
On the other hand, a recent report for Elections
Canada analyzes the three highest profile internet voting elections in
While turnout overall remained
unchanged in the 2003 [
In all, 14 percent of electors [for
Though voter turnout [in Halifax] did
not increase overall (from 2004 to 2008 it dropped from 48 percent or 125,035
voters to 38 percent or 100,708 voters) turnout on advance voting days (where
remote Internet and telephone voting were offered as options) increased by more
than 50 percent (from 14,000 electors in 2004 to 29,000 electors in 2008)
despite it only being offered for a three-day period... Municipal officials
were sufficiently pleased with the 2008 pilot project that they recently
conducted another remote Internet and telephone voting trial as part of a
special by-election that took place on September 19, 2009. This time, however,
the option to vote using the Internet or telephone from remote locations was
continuous (from the first voting day up until and including election day).
This is the first instance in
The Halifax case is particularly compelling because results there likely will lead to cost savings in the future for the overall election, one of the holy grails of internet voting [Goodman, Pammett, & DeBardeleben 2009].
Overall, HRM [
It is important to triangulate these data about voter satisfaction with other data from more research-oriented studies. In a carefully designed academic study that used various data collection methods like pre- and post- election questionnaires as well as focus groups, interviews and log file analysis, 14 field experiments were conducted over various European locations that were in the middle of actual elections for municipalities or professional organizations [Oostveen & Van den Besselaar 2009]. Salient findings from the study corroborate other academic studies as well as the results from Canadian elections.
Different demographics found the internet voting
instances to be a relatively user-friendly experience, with many finding the
experience surprisingly easy and brief. Moreover,
·
If not already in their
standard procedures,
These experiments also corroborate academic studies and Canadian municipal elections results about general voter participation [Oostveen & Van den Besselaar 2009].
The medium apparently does not attract those citizens who are not already politically engaged. This could indicate that the appeal of a new voting system is in general not very high and that turnout is not based on the voting method, or that there are other more organisational issues that play a part. In Orsay, the high number of registered voters may be explained because the City Hall organised the voting session, and all residents received an official letter of invitation.
[Goodman,
Pammett, & DeBardeleben 2009] note the intense marketing campaign for internet voting in
Finally, many studies have shown that internet
voting does have a bias towards younger, technically savvy (or at least
comfortable with computer use), more affluent voters [Caporusso,
Buzzi, Fele, Peri, Sartori, & di Sociologia 2006; Reniu 2005]. As long as elections provide both convenience and Voting Day
voting options, any bias against older, less computer literate is mitigated by
this group’s usual propensity to be engaged in elections. Moreover, the
experience from
Finally, one subtle issue that is presented as a downside to internet voting is that it can perturb the civic-minded, “water cooler” culture that forms around voting places on Voting Day.
[S]cholars ask whether the decline
of the precinct place will change the position of elections and of Election Day
in the way that democracies operate. [Gronke, Galanes-Rosenbaum, Miller, & Toffey
2008]
Finally, perhaps the most
significant social concern is the threat of disintegration of social capital or
civic life. The proliferation of electronic election services has the power,
some say, to alter the nature of electoral participation by causing more
electors to vote alone instead of at a polling place with others. This
threatens to erode civic life, local social networks and groups related to
elections. [Goodman, Pammett, & DeBardeleben 2009]
However, the other
side can also be argued: that internet voting can be the basis for a virtual,
more persistent water cooler culture. As the
In traditional
voting, there are few contact points between candidates and their constituents.
Certainly the vote itself is one; a conversation while canvassing is another. A
website like this mediates, enriches, and keeps persistent a personalizable
(as opposed to a generic sign on the neighbour’s lawn) dialogue between the
candidates and their constituents. Businesses right now are exploring
strategies to maintain dialogue with their customers and they are finding that
social media—blogs, Wikis, Facebook, LinkedIn, and social bookmarking
sites—provide them this opportunity. Blogs and social media groups are now
heavily put to use by politicians in US,
[I]n a dynamic social and technological
environment inaction can have negative consequences. If cultures of shopping,
banking, playing games and socialising are increasingly moving online, the
failure of the political sphere to move in tandem risks confining it to
eccentric marginality. This might be the strongest argument for voting online:
the symbolic message is delivered that democracy is consistent with
contemporary culture. The risk of such symbolism for the political elite – and
a democratic opportunity for citizens – is that online voting will stimulate a
public appetite for a more interactive system of representation before and after
elections. [Coleman 2005]
References
Alvarez, R. M., S. Ansolabehere, A. Berinsky, G. Lenz, C. Stewart III, & T. E. Hall. (2009). 2008 Survey of the Performance of American Elections. Boston/Pasadena: Caltech/MIT Voting Technology Project.
Ballas, A. (2006). E-Voting: The Security Perspective. London: England: London School of Economics.
CANARIE. (2004, February 2). "Canada’s First Study on Internet
Voting Proves Voters Want e-Democracy".
News Release.
Caporusso, L., C. Buzzi, G. Fele, P. Peri, F. Sartori, & F. di Sociologia. (2006). "Transition to electronic voting and citizen participation". In R. Krimmer (Ed.), Electronic Voting (pp. 191-200): LNI Proceedings.
City of Peterborough. (2009, August 21). "City of Peterborough, Internet Information Guide 2006, 2006 e.lection: Go On-line to Be First in Line". 2009
Coleman, S. (2005). "Just How Risky is Online Voting?" Information Polity, 10(1-2), 95-104.
Delvinia Interactive. (2007). Understanding the Digital Voter Experience: The Delvinia Report on Internet Voting in the 2006 Town of Markham Municipal Election.
Enguehard, C. (2008). "Transparency in Electronic Voting: the Great Challenge". Paper presented at the IPSA International Political Science Association RC 10 on Electronic Democracy, Stellenbosch, South Africa.
Enguehard, C., & R. Lehn. (2009, July 13). "Vulnerability analysis of three remote voting methods". Paper presented at the XXI IPSA World Congress of Political Science, Santiago, Chile.
Goodman, N., J. H. Pammett, & J. DeBardeleben. (2009). A Comparative Assessment of Electronic Voting. Ottawa: Canada: Strategic Knowledge Cluster: Canada-Europe Transatlantic Dialogue.
Gronke, P. (2004, September 2-5). "Early voting reforms and American elections". Paper presented at the Annual Meeting of the American Political Science Association, Chicago: IL.
Gronke, P., E. Galanes-Rosenbaum, P. A. Miller, & D. Toffey. (2008). "Convenience Voting". Annual Review of Political Science, 11, 437-455.
Gronke, P., & D. Toffey. (2007, September 2-5). "The psychological and institutional determinants of early voting". Paper presented at the Annual Meeting of the American Political Science Association, Chicago: IL.
Hole, K., & L.-H. Netland. (2010). "Toward Risk Assessment of Large-Impact and Rare Events". IEEE SECURITY & PRIVACY, 8.
Jefferson, D., A. D. Rubin, B. Simons, & D. Wagner. (2004). "Analyzing Internet Voting Security". COMMUNICATIONS OF THE ACM, 47, 10-59.
Jones, D. W. (2004). "Auditing elections". Communications of the ACM, 47(10), 46-50.
Mohen, J., & J. Glidden. (2001). "The case for internet voting". Communications of the ACM, 44(1), 72.
Oostveen, A. M., & P. Van den Besselaar. (2009). "Users' experiences with e-voting: a comparative case study". International Journal of Electronic Governance, 2(4), 357-377.
Pieters, W. (2006). "Acceptance of voting technology: between confidence and trust". Lecture Notes in Computer Science, 3986, 283.
Reniu, J. M. (2005). Improving
Citizen Participation Through the Use of Electronic Voting. Madrid: Ayuntamiento de Madrid.
Sawada, M., D. Cossette, B. Wellar, & T. Kurt. (2006). "Analysis of the urban/rural broadband divide in Canada: Using GIS in planning terrestrial wireless deployment". Government Information Quarterly, 23(3-4), 454-479.
Statistics Canada. (2009). "2006 Census: Community Profiles - Markham". Retrieved March 22, 2010, from http://www12.statcan.ca/census-recensement/2006/dp-pd/prof/92-591/details/Page.cfm?Lang=E&Geo1=CSD&Code1=3519036&Geo2=PR&Code2=35&Data=Count&SearchText=markham&SearchType=Begins&SearchPR=01&B1=All&Custom=
Thurman, J., & U. Gasser. (2009). Three Case Studies from Switzerland. Cambridge, MA: Berkman Center for Internet & Society at Harvard University.
Town of Markham. (2009). "Community Sustainability - Markham's Draft Sustainability Goals - Social+Cultural Well-being". Retrieved March 22, 2009, from http://www.markham.ca/Markham/aspc/sustainability/goals/socialequity.asp
Town of Markham Economic Development Department. (2009). Economic Profile. Markham, ON.
Traugott, M. W. (2003). "Why
Electoral Reform Has Failed: If you build it, will they come?" In A.
Crigler, M. Just & E. McCaffery (Eds.), Rethinking
the Vote: The Politics and Prospects of American Election Reform (pp.
167–184). New York: Oxford
University Press.
COMMITTEE/COUNCIL
ITEM TRACKING
Revised: September 2009
DOES
THE REPORT, PRESENTATION, BY-LAW AFFECT OTHER DEPTS:
Yes No (List all departments impacted and being
consulted on this report.)
Electronic
Approval Required by:
|
Department |
Individual |
Obtained |
|
Commissioner, Corporate Service |
Andy Taylor |
|
|
|
John Livey |
|
|
|
|
|
|
|
|
|
|
|
|
Attachments:
Comments
& Questions: