Tiit Riisalo, Estonia's economic affairs and information technology minister, said that voting should be possible where people live their digital lives.

The minister added that the latter tends to increasingly take place in smart devices rather than computers, which is why it is sensible to make so-called m-voting available on those platforms.

Last Thursday, the government greenlit plans to allow m-voting at next year's European Parliament elections.

"The State Information System Authority (RIA) and AS Cybernetica have prepared a prototype m-voting application," Riisalo said. "We have tested casting, sending and receiving votes using the application, and it is working in both Android and Apple devices. Therefore, we have the technical solution prototype."

Riisalo said that changes to the law necessary to introduce m-voting will be attached to an amendment of e-voting rules that has been making the rounds in ministries for some time.

Arne Koitmäe, head of the National Electoral Service, said that several risks need to be managed before m-voting can be introduced.

Part of control surrendered to digital giants

The question of who controls the voting applications has been the most prominent on people's minds. Koitmäe said that for the purposes of ordinary e-voting (using a computer and the person's ID-card – ed.), the application is set up on a web page managed by the state.

"But using a smartphone, it would all have to go through Apple or Google application stores. The risk is making sure the application the voter downloads is the one uploaded by the elections organizer," he explained.

Tiit Riisalo said there is no reason to doubt the trustworthiness of Apple or Google. "Their application stores are used to offer myriad trust-based services," the minister remarked. "Every bank worth its salt has an application there used to move tens or hundreds of thousands of euros. This means the system is trusted."

Estonian officials recently met Apple spokespeople in London who promised to cooperate fully.

"They proposed a solution where we can check whether the application code has been modified beyond what Apple does to put apps on its App Store," Koitmäe said. "We can prove the code has not been altered."

The National Electoral Service head added that it is necessary to work with the tech companies to have copycat applications removed from the application marketplaces and to expedite the m-voting app and any updates reaching the platforms as soon as possible.

Koitmäe explained that it could take days or weeks for applications or updates to appear on application stores, and that Estonia has been in touch with Apple and Google in terms of how to expedite the process.

Other devices

The third question associated with m-voting concerns the process of the person scanning a special QR code meant to check whether their vote was counted right.

"It is possible to use a different smart device to scan the code," Tiit Riisalo said. "For example, I have both a smartphone and a tablet. It is also possible to use a family member's device, for example."

Oliver Kask, head of the National Electoral Committee, recently told ERR that people should not use a friend or family member's device for the purpose. "There will be a trace in terms of who the person voted for on the device. It does not guarantee secrecy of voting," Kask suggested.

But Riisalo disagrees. "If we already have e-voting where we cannot know who is standing next to or behind the person at the time of voting... We have accepted it as part of e-voting particulars," Riisalo said.

The minister added that the voter is not obligated to check their vote. Arne Koitmäe said as much, pointing out that many people did not own a smart device with which to check the QR code during the first e-elections.

Smart-ID to suffice

The government also agreed Thursday that people should be able to identify themselves using Smart-ID at next year's European Parliament elections. A person currently needs their ID-card or Mobile-ID to cast an electronic vote.

Riisalo said that this is not a technical matter and that the private service is every bit as secure as its public alternatives.

"It makes sense to give it the same legal power," Riisalo said. "We can solve this bottleneck in the e-voting context. It would be wise to analyze whether we can give Smart-ID broader legal powers also in other processes."

Until now, every system operator has decided for themselves whether to trust Smart-ID. For example, the solution cannot be used to access the Marital Property Register.

--

Follow ERR News on Facebook and Twitter and never miss an update!