Norway axes online voting experiment over security threats

For the foreseeable future, Norwegians can no longer cast their votes online.

The Norwegian government this week announced it would end its experiments with voting over the Internet, which it held in 2011 and 2013. Despite the “broad political desire” to make e-voting an option, it said in a statement, the government has decided it was irresponsible to continue spending money on more experiments.

After Norway posted the source code for its e-voting system online, the government faced warnings from security experts that the votes Norwegians were piping across the web weren’t adequately protected. The encryption software didn’t have a good enough random number seed for the algorithm, and the seed value was very predictable, according to security firm Computas.

Other security professionals pointed out that the system could be much less secure for folks voting through a smartphone or tablet. Someone could theoretically hijack the web browser to communicate with the software controlling SMSes on the device, intercepting the inbound SMS receipt after casting a second vote so the original voter wasn’t aware anything had gone wrong. (The system enabled people to vote as many times as they liked, but only counted the most recent vote from a person — an attempt to prevent coercive voting environments.)

Immediately prior to the 2013 trial, software experts told Norway it should scrap the entire system and build a new one from the ground up with better encryption to ensure the data would be adequately protected.

In 2013, around 250,000 Norwegians had the option to cast their ballots online — and roughly 70,000 citizens took advantage of the new system, according to a report examining the outcome of the 2013 trial. But despite that relatively high usage rate, said the report, the turnout rate didn’t change for any group of voters, such as young people.

There was also some evidence that a small number of voters — less than 1% — were successfully able to vote online as well as cast a paper ballot, said the report. Paper ballots received from online voters were supposed to negate their electronic vote.

For all those reasons, there will be “no more experiements with voting over the Internet” any time soon, the Norwegian government said in a statement.

Via BBC