Remote electronic voting: results cannot be verified

From September 17 to 19, elections were held in Russia, including remote electronic (internet) voting. In fact, it was possible to vote remotely online in Moscow and Sevastopol¹, as well as in Kursk, Nizhny Novgorod, Yaroslavl, Murmansk, and Rostov oblasts. In Moscow, 2 million voters (almost a third of the voter list) registered to take part in the remote electronic voting (REV). According to the official data, 96.5% of them voted.

Moscow: long counting, radical change in the results, lack of monitoring

In the capital, the REV was scandalous. First of all, the tabulation of the results was delayed. Secondly, the result of the online voting radically changed the results of the election as a whole, making a strong skew in the direction of pro-government candidates. Third, the 'observers' node' was turned off at exactly 20:00 on September 19.

The Moscow Department of Information Technologies (DIT) explained the delay in the counting by the use of deferred voting (re-voting).

'Everything was recounted several times by morning, just in case, because we had a unique function for people – deferred voting, unlike the rest of the country, – said the head of the department Eduard Lysenko. – This created new features in the blockchain application that Kaspersky Lab implements for us.'

According to him, Kaspersky Lab experts had to conduct 'all-round and multi-vector checks of the accuracy of the chains' to make sure that it was the last vote of the entered ones that was taken into account.

However, independent IT experts are not convinced by this.

'I was an observer, I was a member of the election commission. I will tell you from experience: when there is a delay in counting the votes, it means that something is wrong. The longer the delay, the more they messed up or made a mistake. We can tell from this one moment alone that the electoral commission in Moscow has failed, either technically or organizationally,' Mikhail Klimarev, executive director of the Society for the Defense of the Internet, told Roskomsvoboda.

The biggest question was that the REV results completely changed the picture for Moscow as a whole. According to the calculations of telegram channel 'We can explain', one third more people participated in it than in standard voting: 'More than 1.8 million electronic ballots were issued for the elections in single-mandate districts, and only 1.3 million Muscovites physically came to the polling stations (or voted at home).'

Legend:
Chart on the left: Moscow results without REV
Chart on the right: Moscow results with REV
Green: ‘Smart voting’ candidate 
Blue: ‘Administrative’ candidate

At the start of e-voting in the Duma elections, the number of votes received in single-mandate districts was five times greater than the number of ballots issued. For example, Znak calculated that as of 12:24 Moscow time, when electronic voting turnout was 1.1%, obsever.mos.ru² indicated that voters were issued 22,200 ballots, but there already were 103,200 votes in (5.1%).

Co-Chairman of public movement 'Golos', Roman Udot also noted that the number of electronic votes for candidates in Moscow was 78 thousand more than the number of ballots issued. He called the voting procedure 'a disgrace' and called the elections 'one of the dirtiest' in Russian history. According to Udot, the results of at least electronic voting in the capital should be invalidated completely.

The DIT explained the difference between the two types of voting by the distrust of voters in the REV. '... experts, political scientists, and sociologists have repeatedly discussed the mixed effect of opposition party candidates publicly calling for a boycott of electronic voting. As a result, they might have lost some of the votes of people who didn't want to or couldn't come to the polling station, but couldn't take part in e-voting,' stated the department.

Fyodor Krasheninnikov, author of Republic magazine, believes that the REV will be expanded across Russia.

'Note that we are being told repeatedly over and over again that the pro-government electorate voluntarily and en masse registered for the electronic voting, unlike skeptical oppositionists, and therefore, they say, not surprisingly, that it was the results of the REV that radically changed the voting results in Moscow. Even now it is easy to imagine a scenario of utilizing this experience in 2024,' he writes.

Indeed, presidential press secretary Dmitri Peskov has already stated that electronic voting should be used as widely as possible. And Valentina Matviyenko, the Speaker of the Federation Council, has directly expressed the hope that it may be extended to the whole of Russia during the presidential election in 2024.

Stanislav Shakirov, technical director of Roskomvoboda, also pointed out a third suspicious detail: on September 19 at 20:00 the 'observers' node' (a special computer from which observers could monitor the voting process) was turned off. The key for access to this node was revoked by the FSB, after which it supposedly had to be created anew. Initially, the access denial was explained as a technical failure.

'But none of the observers gained access to this node: not at 2:00, not at 5:00, not at 09:00 when the results protocols were published in printed form,' says Denis Shenderovich, a municipal deputy from the Yabloko party.

The Russian Constitutional Court has pointed out that the right of citizens to participate in government is not limited to free suffrage. Citizens have the right to control the procedures associated with counting and tabulation of votes, as well as the ability to respond legally to violations that are discovered.

'However, in the case of remote electronic voting, the legislators did not provide effective mechanisms for citizens to exercise this constitutional right: the voting and counting system is not transparent even to those with special knowledge of information technology, not to mention other voters,' the 'Golos' movement notes.

All of this undermines trust in online elections.

Experts: 'You can't trust REV'

However, experts say that the electronic voting system could be trusted from the beginning.

'First, the REV can't guarantee that this particular person came and cast a vote and not the DIT people chose for them. Secondly, no one can preserve the secrecy of the vote, in which a person votes without pressure,' Klimarev explained to Roskomsvoboda.

In addition, the online voting system, according to him, is extremely non-transparent. So, the REV must have open-source code. Of course, the DIT published it, but, in the expert's opinion, you can't call it open source: 'it's a set of files without documentation on how the system is set up (what servers, what OS, etc.).' Not only that, but the published "code" need not necessarily have been installed in the REV.

'And the work of the system itself should be under scrutiny: servers – sealed, in the presence of systems of double or even triple keys. Now there are some servers with some system with some code, which could have been changed along the way,' says Klimarev.

Nevertheless, it is possible to make transparent and secure online voting if there is a political will to do so, says Shakirov. However, in the past elections, according to him, 'there was no will for honest and open elections.'

Recall, that according to the developers, the recording of votes is done with a blockchain, which supposedly should provide protection against falsification. Blockchain is a technology for recording information in blocks (block-chain). To change information in one block, it is necessary to change all subsequent blocks. It is usually difficult to do because the network is distributed (all blocks are duplicated on many computers participating in the network – nodes – and mutually verified). Due to the fact that the nodes are not subordinate to each other, any change in the contents of the chain will be rejected. For this reason, recording information in a blockchain is thought to be particularly secure.

However, protection against tampering is only guaranteed when using a distributed network, where nodes are not controlled by the same host. Unfortunately, in the case of the REV system (and some other systems that 'parasitize' on the 'glory' of blockchain technology) this is not the case: all nodes participating in the network are controlled by the same individuals. In this case, we are not talking about a distributed network. As a consequence, it is impossible to defend against counterfeiting the content.

As for the secrecy of voting (in the words of the REV's authors – 'anonymity'), nominally, the authors promise it and even boast of its existence, but with the current implementation of voting systems, there are huge doubts about it.

By the way, the initial 'codes' of the REV systems can be viewed here and here (there are two REV systems in Russia, the federal one by Rostelecom³ and the Moscow one by the DIT).

Allegations of foreign interference and 'defending' the CEC website

In addition to the disputes over the REV's design and results, there were other problems surrounding the elections. For example, on September 17, the electronic voting structures were allegedly under 'DDos-attacks' from the U.S., Germany, Ukraine and other countries, CEC head Ella Pamfilova reported. Because of this, the mos.ru portal⁴ introduced waiting in line mode; when users tried to get a ballot for e-voting, an hourglass sign appeared alongside a message about exceeding the number of simultaneous requests to the system.

On the same day, Roskomnadzor⁵ demanded that Twitter explain as soon as possible why the Moscow City Election Commission account was blocked. The agency viewed the Twitter administration's actions as foreign interference in the Russian elections.

These 'unprecedented attacks' caused the Central Electoral Commission to turn on the protection of its site. On September 19, Sergei Shpilkin, an expert on electoral statistics, noticed that the CEC had put in place a system that did not allow automatic copying of the published election results. He pointed out that if you tried to copy the data from the page, 'strange characters' would appear instead of numbers.

It is interesting that this system is most likely useless for protection against attacks, but it hinders data parsing. According to political analysts, previously it was possible to download any data on the voting results from the CEC website in excel format or copy the data into an excel table from a page in HTML format. Now it is impossible. It turns out that the data are available for viewing, but not for machine processing.

'The "protection" can be circumvented, for example, by printing out a page in the .pdf format, from which you can then extract the usual text. So, all the work was done in vain. But the system does interfere with parsing. Moreover, if the CEC does not like it, one could make an API (a special interface for requesting and receiving data) that would considerably reduce the load on the server', says Vadim Misbah-Solovyov, the technical expert of Roskomsvoboda.

The researchers addressed an open letter to CEC head Ella Pamfilova urging her not to prevent them from scrutinizing the election results.

In addition, the CEC decided to hide its website from Yandex search. On September 21, when searching for 'CEC website,' the search engine displayed only news items with links to the CEC's social networks. The same thing happened with GAS Vybory⁶ site. Google, however, was working as it should.

What will be the public consensus?

On September 22, the Public Headquarters for Election Observation tasked a technical group to recount all votes received from voters during electronic voting in the Duma elections in Moscow. But such a 'recount' will not have legal force. A group of public control of online voting will also be created. The group will be headed by Grigori Melkonyants, co-chairman of the 'Movement for protection of voters' rights "Golos"' (recognized as a foreign agent). Melkonyants himself confirmed his participation in this initiative on Facebook.

'This audit makes no sense. The main falsification goes along the lines of violation of the secrecy of the vote. What is technically posted there does not matter at all,' Mikhail Klimarev is convinced.

On September 23rd, members of Moscow precinct and territorial electoral commissions, together with the election observers, called [on the election administrators] to cancel the results of the Moscow REV. They addressed an open letter to Alexei Venediktov, the head of the public headquarters for election observation in Moscow. The letter says that the electronic voting system 'is an instrument of falsification' and lists the reasons why the REV results cannot be recognized as valid. Thus, in addition to those listed in this article, the following was also mentioned:

- there were repeated reports of voters coming to the polling stations who were surprised to find out that they had been registered in the REV, whereas they had not;

- there were 'technical failures', as a result of which there was no continuous observation of the performance of REV, even though it was obviously insufficient;

- about 300,000 voters changed their vote in the REV system.

'The mechanisms of electronic voting proved to be difficult for public scrutiny, the training and/or search for independently qualified, trustworthy professionals requires substantial time from all concerned (candidates and parties). It is feasible only with the prior publication of the most detailed technical documentation allowing for the training of such specialists. Such an opportunity has not been provided to the interested parties,' summarize the authors of the letter.

UPD: On September 24, the CEC announced that by the next federal election in Russia, a unified system of online voting will be implemented. The option of delayed voting, which was criticized after the REV in Moscow, will not be used.

References:

¹ A major city in the illegally annexed Crimea – REM

² A portal set up for live monitoring of the remote electronic (online) voting in Moscow – REM

³ Rostelecom is the largest digital services provider in Russia – REM

⁴ Official portal of the Moscow city administration – REM

⁵ Russian federal agency for the Supervision of Communications, Information Technology, and Mass Media – REM

⁶ An automated state system of the Russian Federation 'Vybory' (elections) – REM

The original text by Roskomsvoboda may be found here (RU).