Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3204 Thanks!
[Music]
our next speaker mat p is a digital
rights activist from Estonia with an
academic background in philosophy
teaching and informatics he's a former
board member at the local branches of
wikip media and open knowledge and
currently at the internet Society the
internet Society of Estonia he's going
to be telling us about the EV voting
experience of the 2023 parliamentary
elections in Estonia let's give him a
warm chaos
welcome uh well hello everybody um you
see my uh talk is uh framed as a
question and I'm not sure if I will
answer that to you actually but maybe
you can answer it to me
later but it will be about uh electronic
voting in Estonia which has been there
for 20 years almost and uh 13 elections
and five of them have been parliamentary
elections so I was an observer at uh
parliamentary elections this year and I
Tred to make sense of uh electronic
voting as an observer to observe the
processes basically so the numbers are
not really important here but uh
electronic voting happens before the
actual voting day you can download uh an
application and cost your vote uh in in
a week before the actual election day
which is uh from the 27th of February to
the 4th of March in this case and uh the
interesting number is actually that uh
51% of the votes in this uh
parliamentary elections were were given
electronically
so which is kind of milestone for
Estonia but
uh we have to see about it so observing
uh is not really easy uh for electronic
voting for obvious reasons that you kind
of have to see what's happening inside
computers and uh observers have been
present at electronic voting in Estonia
all the time but as it has been about 20
years Observers have kind of lost
interest in in that and also the
authorities have kind of stripped down
the process is to actually observe and
and they don't expect somebody to walk
in and start really observing which is
what I did and
uh uh as you see I have like kind of not
really good uh things to say about it uh
it wasn't uh not successful actually uh
it was quite success ful this observing
but it was really a lot of work uh lot
of technical work but also a lot of
legal work in the sense of filing
complaints and trying to make sense of
the answers trying to socially engineer
myself to certain positions to ask
something from electoral bodies and so
on
so uh what is an electronic vote so here
here you can see an electronic Vote or
ballot uh which one it actually is is
the vote or ballot uh this will become
important later but yeah it's
basically encrypted text which if you
decrypt it you will see something like
that so
uh and even this kind of uh View at at
the electronic vote you usually don't
see because uh uh
the actual content that you send to a
server is hidden behind the voting
application that you have to download
that is available for Windows Mac and
Linux but uh it's a close source
application you download binary and you
don't really see inside
so during my observation I kind of
fought my way into seeing these things
so what is this uh this is
actually pretty simple ballot uh it has
the some details of about uh for what
candidate and party is the vote given
but also uh for which electoral District
the candidate is in and if you're a
voter you are either allowed to vote for
one candidate in one District or another
but so this is important information in
order to count votes
later so um well that's basically what
this electronic vote looks like uh vote
looks like if if you kind of look into
it and and this ballot actually or vote
is inside a uh ZIP container that is uh
digitally signed with this uh Estonian
identity card which is a chip card with
a smart ID and then then you have to
sign it and enter your uh identification
code for that and uh this is now uh a
view that will be
uh you will be shown if you are a
observe normal voter you run this
application you enter your uh auth
authentication pin code then you will be
provided with a candidate list and uh uh
which is uh divided by the parties then
you choose a candidate and uh then kind
of confirm your vote and enter your
secondary pin number which is actually
used to digitally sign the container
that you were uh uh you just saw on the
previous
slide
and then the server will say that the
vote was accepted and will present your
uh you the QR code which is actually
important because uh this QR code can be
used to verify your vote which is
basically to use a secondary device uh
mobile device usually to see that the
vote is still available at the server so
what I did I replicated this software uh
to to download the votes and decrypt
them not on this mobile application but
but just a normal application open
source uh code which is which is
something that um provided me a full log
of my containers that I submitted as
votes so this is the kind of terminal
view uh of the same thing that you saw
be before so it's
just uh program that you run you
uh provide it with a QR code which
looked like that uh and
then you will uh be able to download
the well this is the right slide I think
uh download the vote from the voting
server and uh
and usually the mobile application says
who you voted for like the plain text of
the of the candidate that you voted for
but uh uh this special application
allows you to download the votes and
decrypt them with a key that is
available in this QR code and then you
can basically uh overwrite these limits
of uh verifying your votes which is
usually uh three times uh in 30 minutes
after voting but if you don't download
it you can do it like forever you you
can basically have proof of who you
voted for uh after the elections for
unlimited time and since you can
download you you will be downloading
this full uh container of the vote then
it's also a digitally signed proof of
who you voted for which is actually
something that is by some International
regulations not really uh recommended or
even allowed
maybe
so
uh and another part uh what I did was to
submit my own electronic votes like to
create the votes uh from the beginning
myself
so uh this was
the now I'm going to far well this one
yeah uh uh the communication with the
election servers is is done quite simple
way it's it's uh some uh Json RPC
protocol which is basically Chase on
text and you provide some uh requests or
or comments to the server and you can do
the same that you saw in this voting
application you can do it yourself by
providing this uh um comments so it's an
open protocol so I could just read the
documentation and then write own code to
do it and uh I did just basic job to
submit some votes for testing so I
didn't really write my own voting
application but series of scripts that I
I could use so it's just downloading
this voter list this voter choices and
then submitting my own vote after that
which is the process that uh is kind of
prescribed officially by this
documentation and yeah I I used open S
cell to submit these uh requests also
authentic authenticating with my chip
card and and uh uh uh which which is
required this DLS Connection in a
specific way which was really hard to do
in with some other tools but open SSL
finally
worked so it's basically doing the same
that the official application did and
you get some responses from the server
basically it's uh getting uh
uh the candidate list or or again uh
this example shows if you sub uh submit
a vote you will get uh uh vote ID back
which was one of the fields in this QR
code actually and then you get uh uh
some qualification um proofs about your
uh smart uh this ID um certificate being
valid which is this OSP field which is
actually along you can parse it and see
what's inside and what what are the uh
um time stamps and stuff like that and
the DSP rag is actually time time stamp
registration which is uh storing the
hash of your actual ballot on a
secondary server to kind of uh not able
not enable to not not enable the
running of Runner of the server to
manipulate the votes basically delete
votes so they are registered also in the
separate service which is a uh Estonian
certification agency or rather it's a
private company actually so that that's
what you get if you submit a
vote and uh the first thing that was
interesting that happened during
observation was that U while I was
submitting votes I I got this message
that uh uh election is over since it was
one week and I was
basically trying to figure out this open
SSL and stuff uh during the latest
minute I accidentally kind of passed the
the time when election was over well it
wasn't really accidental but uh in a
sense uh this message confirmed me that
election is over and I can stop my
experimentation as an
observer and uh what actually happened
is that I was able to submit uh vote
after end of election so I had this
message voting is over error message
basically and then I submitted a
container uh 303 minutes later which
really happened by accident I was just
pressing something on the command line
and then pressed enter and then it said
told me that yeah I submitted another
the
vote and
uh it was an experimental uh container
actually which uh has only uh uh
684 bytes which which is uh a bit too
few to actually contain all the
parameters to decrypt the vote so this
uh vote submitted after the election
period is actually is actually an in
invalid container or invalid Vote or
something like that
and and more of more on that later so I
was as an observer having done these
technical things actually during the
election um I wasn't really in a special
position compared to usual voters
because I just uh invented my own tools
to observe a bit more than than is
enabled
usually so I wanted to know if my
containers that I submitted were
actually counted or which of them
actually was counted because the
container submitted after the election
should not have been counted and uh the
other containers uh had had also some
pecul peculiarities for example this uh
uh the container sent uh 30 minutes
after the election was over uh actually
had this two short ballot to be
decrypted which I also submitted just
before uh end of the election and this
could have been caused some could have
caused some problems to electoral
electoral authorities like how to
process that so
and this is the point
basically when I ran into into problems
when I wanted to observe what happened
to my votes I wasn't really allowed to
observe anything first of all there was
uh some sort of informal session uh
before the time time that the counting
should have started by the law uh it was
uh 3:00 at noon when I was actually on
my way to the this official counting
place where I wanted to be present at
this final occasion and when I reached
there I I heard to from some people that
already during the day one vote was
removed as an invalid vote and so I
presume that since I didn't know that
anybody else is uh experimenting with
elections that way and uh um I presume
that this might be my vote but uh as it
was just some kind of rumor uh in the
coffee table that the vote was removed
because of wrong encryption key uh which
wasn't the case so I wanted to really
find out what actually happened
so
and
uh but uh in Estonia we uh have this
official counting which is on the
election day basically night of the
election day which uh was presumed by
some informal session already for some
reason but uh after this official voting
Day election day counting we have a
second day where all the processes uh
should be kind of repeated so The
Observers can make sure that everything
was done correctly and and there you
have more time to ask questions to kind
of uh do a lot of things and uh this is
why I presume that on the second day I
will get this clarity about my my
containers that I submitted which wasn't
the case actually they said that they
cannot kind of inspect my con containers
there because there are some privacy
problems involved that they cannot look
at my containers even without looking
inside and uh
so uh I was um directed to file a
personal data request which I did and uh
it uh after two and a half day I got a
refusal to actually fulfill it so I was
kind of still had no idea what happened
only this rumor from the coffee table
that my vote was declared invalid and uh
then we have of course political parties
in Estonia and we have uh one party that
is contesting electronic voting really
it's the populist conservatives in
Estonia I think probably you have your
own countries also these kind of parties
and and they were kind of saying that
they don't believe electronic voting
results and uh because this turnout
rised 5% which was suspicious to them
and then since all the new voters were
electronic voters they kind of claimed
that they want to observe what happened
basically they wanted to do the same
thing that me besides well not having
this
technical groundwork that I did so since
I my personal data request was denied so
I basically called up this um
conservative people's party and said
that uh I read from newspaper that you
will be having this meeting with the
Electoral commission uh um and I I want
to come with you so they will say they
said like of course like we need
technical expertise please come so I
basically socially engineered into this
meeting myself into this meeting with
this
uh conservative party and the Electoral
committee and I was provided some logs
that uh the party uh was given uh in
response to their data request and I was
analyzing these logs during this session
they were discussing something it was
kind of basic that were basic things
that were discussed but uh
uh inspecting these logs and comparing
to these logs to my containers that I
submitted I claim that there are some
contain is missing so and and I did it
basically at the end of the meeting so
they were kind of nervous what what does
this mean and and I was provided some
sort of private session to to actually
then go and see my containers and and
that's actually uh where I uh got to see
The Ballot Box uh in a form like they
have it and uh it had some problems
which I will be uh mentioning later
but basically it was a private session
to count votes which is something that
is really
counterintuitive
because uh according to Estonia
law
this uh counting of those is supposed to
be public thing so everybody could be
present so I was provided a private
session in this counting so we B what we
did uh with the operator who grabbed
this DVD disc where this Ballot Box was
was on put it in into his laptop and and
then we sit in a room where I was not
able to not allowed to make photos or or
do anything to record anything just to
remember remember things by heart and uh
uh then he wanted to have a cigarette so
we went outside left the computer inside
to un uh uh unpack The Ballot Box that
was still processed so we went outside
and then I I came back first and I think
he was kind of interrupted in the
corridor or something so I went to this
room where this laptop was working de uh
uh de compressing all the votes or at
least my ballots and uh I could have
just taken the laptop and walked out of
the building but as that would be
criminal I didn't do that of course but
but it's a kind of interesting Side
Event but I was able to confirm in this
session that my containers that I
submitted were
received uh but I wasn't able to confirm
which of the containers was uh actually
processed or
how so electoral office actually said
that uh this container submitted after
the election should be removed uh it was
basically said to a
newspaper and uh
since after this private session to
observe my containers I didn't I wasn't
still sure which of them was counted
only I have this
oral notice that maybe the last one that
was had this invalid uh two short ballot
inside this was counted but since it
wasn't really a proof which which of
them was counted I filed an election
complaint
and uh this
complaint uh was filed
uh I think on 13th which makes it uh uh
three days too late or even more days
too late because you have to file
electoral complaints 3 days after the
legal event that has happened and the
legal event in my case would be then the
second counting uh on the uh day after
election day but since I filed my
personal dat request which was denied
then I went to this electoral office to
this uh private vote counting session
and I filed my
complaint uh being inside this limit
this 3-day limit from this private
session and uh this wasn't an argument
for Supreme Court and also not an
argument for voting commission so uh
this complaint was just
dismissed and what is actually
interesting here that uh the last
submitted vote uh it's it's hard to Def
uh detect which one is uh the actual
vote that should be counted because
uh the last vote as defined
by normal dictionaries election
dictionar dictionaries is a a ballot
that is valid that indicates the actual
candidate that you voted for
so from my 26 containers uh the last
vote would have
been uh probably the last valid vote so
since uh this electoral act doesn't
really Define the electronic ballot but
only talks about electronic votes Al
although there are ballots in in the
protocol so it's really ambiguous which
one of the votes should be counted
because what is the last vote if you
don't know if invalid ballot is is also
should be also counted as a vote or is
it only a valid ballot that kind of
produces a vote which is kind of
standard
terminology and in Estonia this invalid
ballots U these are something that
electoral Committee in the case of
electronic voting is really afraid about
or somehow wants to hide it kind of
sheds a bad light for electronic voting
because if you have invalid ballots in
electronic voting then somehow
electronic voting itself is not that
perfect uh as official story goes that
it's perfect and better than b ballot
elections
so this omitting invalid ballots and uh
kind of pretending that there are
electronic
votes uh and no
ballots uh has led to this electoral act
not defining the the ballot for
electronic votes which is usually the
case for for paper ballots for paper
ballots it's really defined what is an a
ballot what is an invalid ballot what is
a canceled ballot there is even like
like a pro procedure to cut off the
corner of the ballot to make it cancel
ballot but for electronic voting none of
this is is there it's just there are
electronic votes and the last one has to
be counted no specifications so it's
really
uh uh for for for me the case is
that uh in electronic voting they have
like different view about the process
and this is probably something uh
related to computers they they presume
computers are in mistakable somehow they
they just count the votes you don't need
ballots to be processed you don't need
to find out which pallots were correct
which one were invalid so uh in a way
this kind of Estonia being proud about
its electronic voting and trying to kind
of push away all the criticisms that
have been has resulted in a legal
obscurity with uh with this electronic
voting where you can cannot actually
make sure which ballots ballots should
be
counted so uh I also uh filed a criminal
report about not counting my vote
because there is a paragraph in Penal
Code in Estonia about it uh this was uh
not discussed and and the Supreme Court
also uh as I already said it didn't uh
discuss my complaint because of a
deadline but then I I looked up at the
data that I showed you before about
these ballots and
uh it it appears that uh the vote
containers produced by official voting
application they didn't have proper
digital signatures and and they they
displayed the instead of this
administrative unit code that you saw in
the beginning it displayed always zeros
like four
zeros and signature is not valid is
displayed by the standard application
that is used to process these ballots so
this is just a screenshot of of
uh one of my votes and you have also
like different tools to make sure that
yeah these containers are not do not
actually have valid digital digital
signatures and this administrative unit
code is zero uh for all cases and uh
basically of course I complained about
that too because they didn't want to
count my vote so I was not really
satisfied with the process and
complained about all rest of the
electronic votes this 51% of the
votes and uh this complaint wasn't
properly discussed so they dismissed my
complaint although they shouldn't have
dismissed it and they referred to
Supreme Court decision which kind of
allowed them to do that
uh but it it actually said that you can
announce the results before the final
decisions about electional comp
complaints are made if the complaints
don't affect the results of the
elections so my complaint about 300,000
votes really would have affected the
results so they kind of rushed
the um announcing the results
so
I I'm kind of trying to wrap it up now
uh I think this basic uh uh diagnosis of
of this uh electronic voting in Estonia
is that uh it was introduced before way
before gdpr and and uh uh Estonia wanted
to have this ID card uh introduced
because um of banking basically that you
could log in into bank and it would be
more kind of secure than this password
sheets that we had
so this ID card was created and
basically electronic voting was created
because of this ID card it
just people found out politicians found
out that electronic voting is a Hot
Topic in 2000s and since we have this ID
card let's do electronic voting and and
it was done and and basically what I was
showing before downloading the
containers uh having this digitally
signed
uh proofs about who you voted for this
is related to electronic ID card and
kind of wanting to use it even in places
where you might not really need to use
it or maybe even shouldn't use it for
example in election if you if you kind
of break ballot secrecy this is a bad
thing and maybe you shouldn't do it but
it's kind of has happened because of ID
card creating the procedure for
electronic voting that
will not honor this ballot
secrecy so there was a petition by
electronic voting observers which is a
rare thing in Estonia that uh there is
this kind of activism from electoral
observers uh we made made some requests
uh that are still discussed at the
parliament uh constitutional Committee
of the parliament I don't know what what
will come from there actually the new
the the updates to electronic voting law
are also in the Parliament and none of
the problems that I have disclosed here
or the things uh mentioned in this
petition are in inside this uh new
uh draft
bill so yeah uh that's kind of it I
think this the main point of this talk
was actually that uh
it was not
really well there is this legal part to
elections and also also this technical
part in in electronic voting and it's
hard to align them in a good way because
technical part is really complicated and
legal part is also complicated but in
another way but you if you are a person
running the election service you have to
kind of understand the
both uh subjects but it seems that there
are completely separated in Estonia so
the software invents everything as it
does people are just running the
software not really knowing what the
software should do having these zeros in
instead of uh administrative unit lines
having this problem legal problem if you
don't have an digitally signed proper
digitally signed container of the vote
then legally you don't have an
electronic vote and uh I think this is
the reason why nobody wanted to discuss
it because legally this would have
caused invalidating uh EV voting results
in Estonia and as usual nobody wants to
do this kind of
thing so and referring back to uh an
older talk from from uh Congress in 2014
it was J Alex halderman speaking about
electronic voting in Estonia here and
basically indicating similar problems
like operational technical problems and
some client side server side attacks and
so
on so Estonia has tried to improve
things but it seems that improving the
processes with
cryptography has made it so complicated
that electoral office themselves is not
able to to run the elections properly
and that's why my kind of Observer
report ends with a recommendation of of
taking up this constitutional review of
electronic voting in Estonia because
because this is something that has been
postponed from 2005 when the system was
first
introduced and and that's it thank
you thank you so much so we do have five
minutes for questions we have election
observers watching the polls on the
internet in Mastadon in Matrix
and in IRC if you prefer the traditional
in-person voting we have four
microphones here and I see already at
microphone number
one yeah um I'm surprised especially
that you know uh Russia looks at Estonia
as kind of its own sphere of influence
that estonians are not afraid that the
voting systems themselves might be
compromised so it looks
like quite uh did did you have a look at
that part of the system is there any
audit security audit of the
systems yes I think there is uh at least
some kind of audit uh uh I think they
have some audits that are not public but
there are some audits that are public
and uh basically one thing that I didn't
describe in describing this uh talk is
that they had really uh
PR preparing the machines for the
election they just downloaded something
from msdn where some kind of operating
system images are and they didn't
protocol it they didn't write down the
checksums or anything and uh there was
another election complaint about it uh
and when we actually went to see the
image that I was provided to to look at
and they were explaining that they
download loaded it from the source and
so on and it's untouched then when we
run ran this image actually icon of this
uh ID card software was on the desktop
as well as not notepad++ sharew or
something so the procedures are not
really there as al already uh Professor
halderman uh observed I think they have
even gotten first worse so I think
electoral committee cannot be sure if
somebody from the Electoral office
somebody I don't know like the somebody
who takes out out trash or somebody or
or or or even some Russian agent kind of
inserts some malur in the system it's
completely possible to do that because
of these lack regulations and and the
procedures can our election Observer
watching the
internet does it look to you that the
observability of the system is so bad on
purpose for like nefarious reasons or is
it just slopp
um it might be a bit on
purpose but
uh it's hard to it would be just
speculating about the
purpose and one of the purposes to keep
the system
simple so you would be able to run
it and another purpose is something that
is talked about a lot uh is this end to
end verifiability that is kind of
Presumed from this kind of voting system
systems and Estonia has dismissed the
idea for a long time and some of the
cryptographical proofs were introduced
in 2013 some of them were introduced in
2017 but they don't cover this system
end to endend from like if you look at
from this uh look at the system from
this scientific concept that is used
so the reason ing for not doing that is
that then voter could be able to prove
who he voted
for which is actually a property of the
current system as I showed you can
download the vote container you can
decrypt it the container is digitally
signed you can prove who you voted for
already in current system so this
argument of not introducing endtoend
verifiability Pro in a proper way is is
just false because uh
uh it's it's kind of really suspicious
that they don't want to do it because
this way at least some people would
recognize Estonian electronic voting as
some kind of good example although there
might be other problems like this R
called B
system emerging but
uh I think it's it's just
uh either too few people uh who
understand these all different all these
different problems of cryptography uh
legal parts and also the political and
social Parts but then again it might be
somebody trying to keep the system weak
like uh on purpose in order to
manipulate it and as elections are
really like parties fighting with each
other trying to win and doing almost
anything about it then I cannot rule out
that that this is something
created uh this kind
of shady manner um in order to enable
manipulation so unfortunately we've run
out of time the polls are closed uh all
ballots that have not been asked will
not be answered unless you find our
speaker Meritt afterwards either next to
the stage or follow them wherever they
end up today so let's give them another
thank you big warm round
[Applause]
[Music]
Applause