Adding facial recognition technology to e-voting is feasible but there are additional risks that may not outweigh the benefits, a study by the State Information Systems Authority (RIA) and Cybernetica has found.
Cybernetica AS found that introducing facial recognition would require big technical changes. It would increase the risk of e-voting failures and significantly increase the system's performance requirements. It would also be impossible to reset the error rate to zero.
The company found that the e-voting service would become more inconvenient for the user as it requires the presence of a device with a proper camera and the ability to use it which would crate additional access barriers. Privacy intrusions would also be created.
Instead of facial recognition, there are other smaller measures that could be introduced. These include informing a person by e-mail or SMS that they have cast a vote and creating good practice guides for care homes to store ID cards.
Arne Koitmäe, head of the State Electoral Service, said the inclusion of facial recognition requires a social agreement on what level of biometric identification is reasonable and acceptable to the majority of people.
"There is currently no agreed security standard for facial recognition technology and there is no wider societal practice of using it by a large number of people at once. Therefore, it seems premature to use this solution in elections," he said.
Koitmäe added that e-voting in its current form is based on the foundations of the digital state which Estonian residents use every day and trust. He said if biometric data is to be included then, first, it must work well for all public services.
However, Koitmäe said alternatives proposed in the study to increase the security of elections could be considered.
"The analysis proposed the creation of an automatic notification system for e-voters, as an additional security measure, to notify them by e-mail or SMS when a vote has been cast with their electronic identity. A similar notification system is currently used in banking, where it is possible to notify users via a mobile application when a payment has been made with their bank card or money has been received in the account," Koitmäe said.
There are many complex issues associated with biometric data which is why RIA does not currently recommend using it in elections.
RIA Deputy Director General Margus Arm said introducing biometric authentication solutions would require "fundamental changes" to Estonia's existing digital identification system.
"We do not have an overview of the safest solutions, we should not rush to add this option," he said. "There are also a number of organizational issues, such as the availability of a proper camera and other tools that may prevent e-voting."
Last year, former Minister for IT and Foreign Trade Raul Seim (EKRE) suggested that adding facial recognition technology to e-voting would make the system more secure and reduce the possibility of voter fraud. He suggested smartphone cameras could be used by voters. The party has questioned the security and reliability of e-voting in the past.
Editor: Helen Wright