Presidential: “The level of online voting security is still insufficient”

The French themselves seem to be getting impatient. According to an Ifop poll carried out at the end of 2021, 65% of respondents believe that remote electronic voting would be effective in encouraging more people to participate in the next presidential election and 61% could consider using it.

But behind this enthusiasm persists a diffuse distrust: one in two French people questioned fears a manipulation of the results. Fantasy or real threat? The point with Véronique Cortier, researcher at the CNRS, specialist in computer security protocols.

The French themselves seem to be getting impatient. According to an Ifop poll carried out at the end of 2021, 65% of respondents believe that remote electronic voting would be effective in encouraging more people to participate in the next presidential election and 61% could consider using it.

But behind this enthusiasm persists a diffuse distrust: one in two French people questioned fears a manipulation of the results. Fantasy or real threat? The point with Véronique Cortier, researcher at the CNRS, specialist in computer security protocols.

In 2017, the last government of Holland’s five-year term refused to use online voting due to a high threat of cyberattacks. What about today ?

I cannot say if the threat of cyberattacks is higher or lower compared to 2017. This is information that I do not have access to. What I can say with certainty is that even today, there is no solution to achieve the level of security offered by voting at the ballot box, as it is organized in France during the big elections. Although progress is being made on guaranteeing the secrecy of the vote and online transparency, the level of security is still insufficient.

Is the threat of cyberattacks on a voting server from abroad therefore real?

Clearly, yes. Very concretely, if a foreign power wants to attack a voting system, there are several points of attack. First, by placing “dormant” viruses on personal computers which, on election day, will vote for B when the person wanted to vote for A. And there is no need to compromise a majority of computers, it has to be subtle to swing the election.

Then there can be virus attacks on the server, but also corruption. The employee of an online voting service provider can, for example, modify a few lines of code in exchange for money. For us, IT security experts, these are completely possible scenarios today.

“Under cover of industrial secrecy, we do not know what online voting providers use as protection solutions”

Do the online voting service providers put in place all the safeguards to authenticate the voter, guarantee the secrecy of the vote, counter hacking attempts?

It depends on the platforms. Unfortunately, in France, we do not know what providers use as protection solutions. This under cover of industrial secrecy… There is no communication on the subject. It is a mistake. As a citizen, you have the right to know how an online voting system works. There must be an explanation for the general public, but also a technical explanation with independent experts.

This is the case in other countries. In Switzerland, for example, there is a public assessment: if there are flaws, in principle, they are identified. There is even a reward system for those who detect them, which can currently go up to 230,000 euros! All individuals can claim it.

“If people question the results of the polls, it is a danger for democracy”

In France, it is the National Authority for the Security and Defense of Information Systems (Anssi) which supervises the voting of French people abroad. She brings interesting technical skills, but she is not independent.

The Cnil (National Commission for Computing and Liberties) changed its recommendations in 2019, setting new security objectives to be achieved by providers of voting system solutions. As experts, we would like it to go even further.

In Estonia, where voting has been dematerialized since 2005, voters can return to their online vote several times – up to four days before the election! – and even end up voting physically if he suspects fraud…

This country is a pioneer in electronic voting. Allowing multiple voting provides a lot of guarantees in terms of security. It is, for example, a first defense against family coercion. This partly limits coerced voting.

Although the idea is premature for the presidential election, will online voting develop in the years to come in France?

Electronic voting already exists for French people abroad and works well for certain local polls: professional elections, primaries, consultations, etc. It is set to develop as a replacement for postal voting, and for all elections where it is complicated to physically organize votes at the ballot box. In my opinion, it is not desirable for the moment to generalize it when the paper vote is satisfactory.

How long will it take for him to win in major elections in France?

Researchers will take a long time – ten years or more – to set up a solid online voting system, with very low cybersecurity risks. I repeat, this is not the case today. And when the time comes, only experts will understand how it works. This poses a real problem: it will only be a debate of experts and there will be no support from public opinion.

When we currently see all the conspiracy theories being developed, if people don’t have confidence, I fear that I will not be able to convince people of the security of a computer system, however reliable it may be. And if people question the results of the polls, it is a danger for democracy. It will take decades to put in place an effective and truly comprehensible protocol for the general public.

Abroad

Estonia is today the only country in the European Union to have introduced online voting on a national scale. Authorized and supervised since 2005, Internet voting is used for local, European and legislative elections. To vote, voters use their digital ID cards with a unique, encrypted electronic signature.