Source code of the Estonian online voting system
Estonia’s open-source online voting system prompts a broader debate over whether internet voting can ever be as trustworthy as paper ballots. Commenters examine how often the published code is updated, the gap between source code and the opaque hardware/firmware actually running in elections, and whether cryptographic schemes can reconcile verifiability with ballot secrecy. Many conclude that while Estonia’s high-trust context and transparency help, large-scale adoption in higher-stakes environments raises unresolved questions about coercion, supply-chain attacks, and public confidence.
Repository and Estonian System Details
- The GitHub repo is explicitly for publishing the exact source used in each election, not for active development.
- Updates appear to coincide with real elections (national parliament, municipal, EU), so multi‑year gaps are expected.
- Development is supervised by the Estonian State Electoral Office; code is synced here when used in binding elections.
- Estonia uses a two-stage architecture: an authenticator validates and anonymizes votes, then a separate system counts them with one‑way communication.
- A separate verification tool lets voters confirm that the server registered the vote they cast; international observers (e.g., OSCE) monitor elections.
Verifiability vs. Secret Ballot
- Central tension: how can a voter be sure their vote was counted without breaking ballot secrecy?
- Many argue full individual verifiability and strong secrecy are fundamentally at odds, especially if you must be able to prove how you voted.
- Others counter that modern cryptography (zero‑knowledge proofs, mixnets, end‑to‑end verifiable schemes) can reconcile secrecy and verifiability in theory, citing existing academic and open‑source systems.
- Skeptics respond that even if mathematically sound, these systems are hard for the public to understand and trust.
Cryptography, Blockchains, and ID Cards
- Proposals: use national ID cards as signing keys, publish hashes/signatures for all votes, allow later verification or revoting, and use blockchain‑like append‑only logs.
- Counterpoints:
- Root‑of‑trust problems (who generates and secures keys, hardware, firmware, supply chain).
- Device compromise and “trusting trust” issues.
- Risk of coercion and vote‑selling if voters can demonstrate their vote to others.
- Lost keys or operational failures (e.g., inability to decrypt) could force reruns and undermine legitimacy.
Paper Ballots vs. Electronic Voting
- Strong support for hand‑marked paper ballots plus scanners and timely, random manual audits:
- Visible, intuitive chain of custody with local oversight.
- Fraud is possible but hard to scale across many polling places.
- Critics note paper also fails: ballot shortages, misdelivery, long queues, “graveyard voting,” and miscounting.
- Some argue e‑voting chiefly helps with mail‑in, overseas, and disabled voters, though opponents say access could instead be handled with better logistics for paper.
Trust, Legitimacy, and Context
- Several comments stress that elections are about producing broadly accepted consent, not mathematically perfect tallies.
- Digital systems are seen as opaque “black boxes,” whereas paper processes can be directly witnessed by ordinary citizens.
- Estonia is described as a high‑trust society where e‑voting is widely accepted now, but some fear restoring trust would be harder if it were ever lost in a fully digital system.
- Examples from Brazil, Switzerland, France, Australia, and the US illustrate that both paper and electronic approaches have significant, context‑dependent tradeoffs.