Ontario civic elections: the problem with online voting

A Western University professor who studies cyber security is urging Ontario municipalities to truly understand how online voting works before it's implemented, a technology that he warns carrieslittle transparency and hasno guaranteethat votes are being counted correctly.

It turns out hand counting paper ballots is the best solution we have.- AleksanderEssex

AleksanderEssex, a professor of computer science, who heads a Western University lab that investigates issues of online security and privacy calls online voting "one of the greatest open problems in cyber security."

Online voting: one of the greatest open problems in cyber security

6 years ago

Duration 0:46

Online voting: one of the greatest open problems in cyber security

It comes after many of Ontario's more than 400 municipalities have already made up their minds whether or not they will use the technology when Ontarians go to the polls in provincewide civic elections onOctober 22, 2018.

The province requires municipalities to pass a by-law allowing anonline ballot byMay 1, 2017 in order to allow online voting in the 2018 civic election, but the problem, according to Essex, is there's no comprehensive governmentlist tracking which communities are using a technology that has no defined standards,limited transparency and no way to ensure votes are being registered correctly.

Why we haven't quite figured out online voting

Why we haven't solved online voting

6 years ago

Duration 1:13

Why we haven't solved online voting

The problem is exacerbated by the fact that some municipalities don't even know where the servers they use for the online voting are located.

Online elections are really not local elections.- AleksanderEssex

"The election server itself may not even be in Canada," Essex said. "We did a study last year on the Western Australian state election and we found the private keys.These are the encryption keys to protect you ballot and voter credentials.We found those keys living on servers all over the world, including in China."

"That's not a hack that's just the way the cloud provider provides denial of service protection. What we're seeing is that online elections are really not local elections, there's really a multi-national character to the server infrastructure."

Essex said online voting also leaves the election potentially vulnerable to hacking, through malware, most likely on a home computer.

A number of Ontario cities and provincial agencies have already proven they're vulnerable tocyber attacks, including the cities of Pickering, Cambridge, an Oshawahospital, the Ontario Privacy Commissionerand the Ottawa-Carleton District School Board.

Why communities need an online voting disaster plan

Why online voting should come with a disaster plan

6 years ago

Duration 0:46

Why online voting should come with a disaster plan

Essex said while most cities have plans in place for tornadoes or floods, none of the communities he's spoken to have a plan in case an election is derailed because of electronic abnormalities.

"I have yet to receive a fulsome answer to that question from any city," he said.

In fact, the practice of online voting is so potentially problematic, some municipalities, like London, Ont., have written it off completely.

"Municipal Council determined to not move forward with online voting as concerns remain with the security," London city clerk Cathy Saunders wrote to CBC News in an email. "There would also be a substantial additional costto move to an online voting system for a city of our size and research has not concluded that online voting increases voter turnout."

'I don't have a disaster plan'

Other communitieswill be trying online voting for the first time in 2018, including St. Thomas and Sarnia, Ont. Both cities hope that using the technology will increase voter turnout, which usually hovers between 30 and 40 per cent.

However, both cities could not provide a disaster plan to be implemented in case the election is hacked or irregularities tipthe balance in favour of a candidate who should not have been elected.

"We're hoping nothing does happen," said St Thomas city clerk Maria Konefal.

"I can't really speak to that at this point,"Sarniacity clerk Diane Gould-Brown said. "I don't have a disaster plan in place right now, I'd have to talk to my vendor about that."

'You're protecting how somebody votes'

That vendor, Intelivote,the Dartmouth Nova Scotia company has also been hired by 102otherOntario municipalities to conduct online voting this year.

"A disaster plan in IT terms is not so much the wrong person got elected, it's what happens if the computer equipment malfunctions," said the company's president Dean Smith.

In order to guard against that, Smith says his company replicates the data on another server so that if something goes wrong with the equipment, forensic teams can figure out what happened and determine if voter data was compromised.

Smith said his company keeps its servers in Canada, in order to satisfy legal requirements by Canadian elections officials, which stipulates the vote must be kept secret.

You're protecting how somebody votes. You never want to allow anybody to know or understand or see who they've actually voted for.- Dean Smith

"You're protecting how somebody votes. You never want to allow anybody to know or understand or see who they've actually voted for," he said.

"People say 'you must know,' but no sorry, we don't.It's encrypted and when it gets decrypted, the results are there, get tallied and made available to elections officials."

It's that element of mystery thatprofessor AleksanderEssex, a man who has made a career out of studying electronic voting, maintains that despite vendor assurances,there are no guarantees online voting systems actually reflect voters' true intentions.

"An online election doesn't have the transparency there, it's not an evidence-based election the same way a paper ballot is," he said."My preference would be to vote online, but with this specific problem it turns out hand counting paper ballots is the best solution we have."