Ontario civic elections: the problem with online voting
Aleksander Essex says there are no Canadian standards governing how voter data is kept safe
A Western University professor who studies cyber security is urging Ontario municipalities to truly understand how online voting works before it's implemented, a technology that he warns carries little transparency and has no guarantee that votes are being counted correctly.
It turns out hand counting paper ballots is the best solution we have.- Aleksander Essex
Aleksander Essex, a professor of computer science, who heads a Western University lab that investigates issues of online security and privacy calls online voting "one of the greatest open problems in cyber security."
It comes after many of Ontario's more than 400 municipalities have already made up their minds whether or not they will use the technology when Ontarians go to the polls in provincewide civic elections on October 22, 2018.
The province requires municipalities to pass a by-law allowing an online ballot by May 1, 2017 in order to allow online voting in the 2018 civic election, but the problem, according to Essex, is there's no comprehensive government list tracking which communities are using a technology that has no defined standards, limited transparency and no way to ensure votes are being registered correctly.
Why we haven't quite figured out online voting
The problem is exacerbated by the fact that some municipalities don't even know where the servers they use for the online voting are located.
Online elections are really not local elections.- Aleksander Essex
"The election server itself may not even be in Canada," Essex said. "We did a study last year on the Western Australian state election and we found the private keys. These are the encryption keys to protect you ballot and voter credentials. We found those keys living on servers all over the world, including in China."
"That's not a hack that's just the way the cloud provider provides denial of service protection. What we're seeing is that online elections are really not local elections, there's really a multi-national character to the server infrastructure."
Cities in Southwestern Ontario using online voting in 2018:
- Sarnia
- St Thomas
- Stratford
- Cambridge
Cities in Southwestern Ontario not using online voting in 2018:
- London
- Windsor
- Kitchener
- Waterloo
Essex said online voting also leaves the election potentially vulnerable to hacking, through malware, most likely on a home computer.
A number of Ontario cities and provincial agencies have already proven they're vulnerable to cyber attacks, including the cities of Pickering, Cambridge, an Oshawa hospital, the Ontario Privacy Commissioner and the Ottawa-Carleton District School Board.
Why communities need an online voting disaster plan
Essex said while most cities have plans in place for tornadoes or floods, none of the communities he's spoken to have a plan in case an election is derailed because of electronic abnormalities.
"I have yet to receive a fulsome answer to that question from any city," he said.
In fact, the practice of online voting is so potentially problematic, some municipalities, like London, Ont., have written it off completely.
"Municipal Council determined to not move forward with online voting as concerns remain with the security," London city clerk Cathy Saunders wrote to CBC News in an email. "There would also be a substantial additional cost to move to an online voting system for a city of our size and research has not concluded that online voting increases voter turnout."
'I don't have a disaster plan'
Other communities will be trying online voting for the first time in 2018, including St. Thomas and Sarnia, Ont. Both cities hope that using the technology will increase voter turnout, which usually hovers between 30 and 40 per cent.
However, both cities could not provide a disaster plan to be implemented in case the election is hacked or irregularities tip the balance in favour of a candidate who should not have been elected.
"We're hoping nothing does happen," said St Thomas city clerk Maria Konefal.
"I can't really speak to that at this point," Sarnia city clerk Diane Gould-Brown said. "I don't have a disaster plan in place right now, I'd have to talk to my vendor about that."
'You're protecting how somebody votes'
"A disaster plan in IT terms is not so much the wrong person got elected, it's what happens if the computer equipment malfunctions," said the company's president Dean Smith.
In order to guard against that, Smith says his company replicates the data on another server so that if something goes wrong with the equipment, forensic teams can figure out what happened and determine if voter data was compromised.
Smith said his company keeps its servers in Canada, in order to satisfy legal requirements by Canadian elections officials, which stipulates the vote must be kept secret.
You're protecting how somebody votes. You never want to allow anybody to know or understand or see who they've actually voted for.- Dean Smith
"You're protecting how somebody votes. You never want to allow anybody to know or understand or see who they've actually voted for," he said.
"People say 'you must know,' but no sorry, we don't. It's encrypted and when it gets decrypted, the results are there, get tallied and made available to elections officials."
It's that element of mystery that professor Aleksander Essex, a man who has made a career out of studying electronic voting, maintains that despite vendor assurances, there are no guarantees online voting systems actually reflect voters' true intentions.
"An online election doesn't have the transparency there, it's not an evidence-based election the same way a paper ballot is," he said. "My preference would be to vote online, but with this specific problem it turns out hand counting paper ballots is the best solution we have."
Corrections
- An earlier version of this article stated that "Municipalities had until a May 31, 2017 deadline, to tell the province whether they would hold an online ballot." The deadline for municipalities is actually May 1, 2017 to pass a by-law that allows online ballots in the 2018 civic elections.Apr 04, 2018 12:51 PM ET
ABOUT THE AUTHOR
