Political scientist: The time is up for more experiments with e-voting

Christoph Bieber, Professor of Digital Democratic Innovations at the Bochum Center for Advanced Internet Studies (CAIS), recommends the use of voting machines in Germany. "We can't wait until all 100,000 eventualities have been mapped" and averted, he explained on Tuesday at a virtual meeting of the Data Democracy working group of the private-state initiative D21 on the "super election year" 2024. However, it is crucial that e-voting is embedded in a state audit and control system in order to evaluate processes and eliminate potential errors immediately.

At the same time, Bieber assumes that it will be a while before e-voting is also used for major political votes in Germany: As long as the burden of responsibility in Germany lies with the Federal Statistical Office or honorary election officials, no development is to be expected, he says. However, the political scientist believes that the diseases from which computer-based voting machines suffer have largely been eradicated.

There are repeated reports of "voting machine massacres" in the USA. At the DefCon 2019 conference, for example, hackers managed to undermine the protective functions of over a hundred devices within two and a half days. These were systems that were approved for use in at least one federal state at the time. The Chaos Computer Club (CCC) once even taught Dutch voting machines how to play chess. It still regularly warns against e-voting and online voting.

Most of the hacked systems were not used in a specific election, Bieber counters. Fewer and fewer devices are being connected to online networks. The attack surfaces are smaller for stand-alone variants. The machines are becoming "technically more and more stupid" and are concentrating on casting and counting votes. In Brazil, for example, the machines only have keyboards with ten characters, while in India "very reduced devices" are also used. "Painful learning processes" have taken place, but these have now been sufficient over time. It is crucial that legal and technical security is guaranteed in these countries and in the e-voting pioneer Estonia through government controls. There are also specialized laboratories there that put voting computers through their paces.

Voter turnout in Estonia has at least remained the same

In the self-proclaimed "E-stonia", the state election office and the additional election commission, which are responsible for the organization, further development and controls, have sufficient budget and personnel to ensure the legal security of e-voting there, Bieber emphasized. In fact, it should have been possible to vote this year in the European elections using your cell phone ("Swish and Vote "), but the experts had not yet deemed this option to be sufficiently secure and had postponed it.

According to the political scientist, the proportion of voters who vote digitally has risen steadily in Estonia and is now around half. Although voter turnout has not increased, it has at least stabilized: "We don't know how many citizens would vote without e-voting." Overall, a "robust voting procedure" has developed over 20 years that is now accepted by the majority of the population.

According to the researcher, two other member states also gained experience with e-voting during the European elections. In Belgium, voting machines were used in almost 200 municipalities in official locations as support. As in the USA, for example, there was a paper trail ("Voter-Verified Paper Audit Trail") so that citizens could track their votes. Users could identify themselves with a chip card and select a candidate on the screen. They were then given the ballot paper and had to scan it. Finally, the ballot paper was also dropped into the ballot box so that an analog recount could be carried out if necessary.

Every step is traceable

Around 70,000 machines from the same manufacturer were also used in polling stations in Bulgaria in June, the scientist reported. The approach used here involves mirroring the analog ballot paper to function as a paper receipt. Ultimately, however, the digital vote is stored and counted. Some machines also produce an analog ballot paper, which is inserted into the ballot box but is only used for recounting.

Jan Wegner from Polyas, the Kassel-based specialist for electronic voting, emphasized that it is particularly difficult to comply with the principles of universal, equal, free, secret and traceable voting, especially in postal voting. Identification is already difficult, and the paper documents pass through many hands, not all of which can be checked. With Polyas, on the other hand, cryptographic mixing processes are used to implement the irreversible separation of voter and ballot paper. Before the digital ballot box is distributed, it is ensured that the identity is irreversibly removed. Blockchain-like bulletin boards also ensure "that only data can be added". In the event of changes, there is a "break in the chain".

Overall, every step can be traced, Wegner explained. Polyas uses a process certified by the German Federal Office for Information Security (BSI) based on an international standard that has been in force since 2018 and was updated three months ago for end-to-end verifiability. Everything runs "with a net and a double bottom". Manipulation can never be ruled out 100 percent, "but it is easier to detect here". The computer scientist advocated the use of such procedures for the 2026 company elections, among other things. Online identification should also be simplified in this country. So far, the digital voting system from Polyas has been used at the CDU party conference in 2021, for example.

(olb)