The EAC Certification Division has released the technical report “A Survey of Internet Voting,” a comprehensive review of Internet voting systems used in elections worldwide between 2000 and 2011. EAC staff conducted the study to assist in the development of electronic absentee voting guidelines, specifically to assist the Commission’s efforts to identify technologies that could improve services for military and overseas voters and voters with disabilities.
[From the report]
… Risk is a difficult concept to express, understand and measure. This is apparent in the means used to address risk from one project to the next. The EAC has knowledge of 13 formal risk assessments, and seven of these risk assessments are publicly available. Nearly every project used a different assessment methodology to measure risk.
In some instances, projects compared the risks associated with various forms of Internet voting with the risks of other, more traditional voting channels. At least seven projects – Austria, DCBOEE, Geneva, Honolulu, NSW, SERVE and VOI – decided to compare the risks associated with their Internet voting projects to the risks associated with postal voting. For example, Geneva listed the risks associated with their traditional voting channel alongside the risks associated with their proposed Internet voting system. If a risk existed in both channels, it was deemed acceptable. The DCBOEE employed a similar methodology, with the additional goal of limiting the introduction of new threats to the voting process.
If new threats were introduced, they were mitigated in some way. To apply this methodology to systems used by United States military and overseas voters, a detailed risk assessment on the postal voting system in the United States is needed. As a first step, the EAC released a whitepaper titled Uniformed and Overseas Citizens Absentee Voting Act Registration and Voting Processes detailing the current postal voting system in the United States.
The EAC is in the final stages of approving a risk assessment methodology for assessing the risks associated with multiple voting channels, known as the Election Operations Assessment (EOA). It includes a user tutorial and a set of risk scenarios and assessment templates, which can be used without expert assistance. The risk scenarios can be modified and additional scenarios added, as necessary, for any type of voting channel or risk environment. One of the features of this tool is that it captures the assumptions made by the users when assigning risk values. This allows for the assumptions and risk values to be changed and the risk assessment run again to provide a sensitivity analysis of the results. Once published, the EOA will provide a useful tool for jurisdictions and other interested parties to perform voting system risk assessments.
After collecting and reviewing information for the projects highlighted in this report, the following areas remain open for discussion and analysis:
• Closer analysis of voting protocols used by Internet voting systems may be necessary to understand the security benefits provided by each voting protocol.
• There may be a need for an international standard solely dedicated to Internet voting an uncontrolled environment.
• There may be a need for a standard risk assessment methodology that local, state, and federal jurisdictions can follow.
• A uniform risk assessment methodology for all voting channels may be necessary for a comparison of the risks associated with each voting channel. Each project managed risks and the technical challenges of
Internet voting in their own way.
• A dedicated forum or organization for communicating experiences or sharing information about Internet voting projects and/or innovations may need to be developed. A forum could facilitate discussion regarding obstacles and innovations in Internet voting; the creation of a standardized language to discuss Internet voting; best practices learned from those implementing pilots and continuous use systems; and an accurate history of the development of Internet voting.
Full Article: Blog Details A Survey of Internet Voting.