Introduction

Definition of electronic voting

Electronic voting is a dematerialised, self-counting voting system in which voters use electronic devices to record their votes.

The system can be used remotely via internet voting, or in person where voters can visit polling stations equipped with voting machines.

History of electronic voting in France

The first traces date back to…1969!

The French Minister of the Interior, Raymond Marcellin, had the use of 100% mechanical voting machines authorised[i]. Due to major breakdown and the failure to reduce fraud, these machines fell into disuse, but the amendment made to the electoral code remained.

Use in professional elections

In the 2018 French public sector professional elections, 5.15 million public employees were asked to vote using an electronic voting solution.

In 2022, 5.6 million public employees in the three branches of the civil service are called upon to vote for their union representatives in the representative bodies. The ballot took place from the 1^st to the 8^th of December 2022. This was precedent in several respects, including the generalisation of electronic voting in the civil service and the establishment of new bodies for social dialogue[ii].

Experiments underway for voting by French citizens abroad

For the 2017 elections, the Ministry of Foreign Affairs and International Development had developed an online voting platform for French citizens living abroad to participate in the legislative elections.

Types of voting in French organisations

Since 2018 in the French private sector, it became compulsory for companies with more than 11 employees to hold elections for members of the staff delegation within the social and economic committees (CSE), by secret ballot

In all cases, the employer should inform the workforce every four years (unless the industry agreement provides for a shorter period of between two and four years) by posting notices of the elections.

How electronic voting works in the context of professional elections

Prior to the vote, the employer must call the professional elections specifying the date, place, and voting method (paper, electronic, or hybrid).

The organisation of elections is generally based on one or more centralised polling stations and regional polling stations, depending on the volume of votes and voters. The polling station members are trained, the solution is assessed, and test elections are held.

Once the solution has been validated it goes into production, and the election can begin:

The electoral lists are drawn up and unions or employees can check and report any errors or omissions.
Candidates can campaign to the voters and present their program.
On the day of the opening of the vote, the solution is sealed using private encryption keys, where 1/3 is held by the corporate administration and 2/3 by the trade unions.
Voters then vote according to the designated timetable, the polling stations monitor the counting of votes and assist the voters, the supervision unit monitors the process and manages any incidents, and the provider company is mobilised if necessary.
On the closing day of the elections, the integrity of the ballot box (urn) is checked, and the unsealing is carried out by the administration and the trade unions.
The counting of the votes is then carried out under the control of the centralising polling stations.
The results of the elections should be communicated to the voters, publicly displayed, and sent to the labour inspector (“Inspecteur du travail”).
The ballot box is sealed again, and the entire solution (including copies of source and executable programs, voting materials, vote count, results and backup files and files that keep track of interventions on the system) is archived under seal for a minimum of 2 years.
In the event of a dispute, an appeal may be lodged with the labour inspector or the district court.

What are the opportunities and risks in electronic voting?

Opportunities

Ease of implementation of the ballot

Electronic voting is generally more efficient to implement than paper voting, requiring less manual work for preparation (printing of propaganda posters, logistics, etc.), counting and reporting of results. This leads to a reduction in costs and an improvement in the efficiency of the electoral process.

Reducing the carbon footprint

Electronic voting greatly reduces the dependence on paper printing for electoral lists, propaganda documents, and especially ballot papers. It also drastically reduces travel depending on the geographical organisation of the company.

According to a study by Kercia[iv], the carbon footprint of a postal vote is more than twice that of an electronic vote.

Maximising participation and elected bodies with a broader electoral base

Electronic voting allows for greater voter participation.

A study conducted in Switzerland in 2011 showed that turnout increased by 2.2%[v] in cantons that implemented e-voting compared to those that did not use this method. Similarly, a study in Estonia in 2014 found that the use of e-voting increased voter turnout by 3-4%[vi].

Voters can vote remotely without having to physically travel to the polling station. This can increase voter turnout, especially in the context of the widespread use of remote work post-COVID-19.

Agreements with a stronger democratic basis

E-voting can help to strengthen social dialogue due to wider outreach and greater accessibility for voter participation. The results of elections are more convincing by increasing the participation in the polls.

Risks

Alteration of results

Electronic voting systems can be vulnerable to attacks such as the usurpation of voter accounts, multiple votes by the same voter in the same election, or the compromise of ballots.

Protection of personal data

The implementation of e-voting platforms should consider the risk of excessive collection of sensitive personal data such as voters’ political opinions.

Voters’ personal information may also be stored on vulnerable servers, exposing this data to the risk of compromised voting secrecy or data leakage.

Transparency of voting operations

It can be difficult for each stakeholder to understand how votes are recorded and how the results are tabulated, leading to mistrust of the solution and the election results.

These risks must be considered and mitigated in order to drastically reduce the probability of occurrence and/or their impact on the smooth running of the elections.

How to comply with the regulations?

CNIL deliberation 2019-053 of 25 April 2019

The CNIL (National Commission for Information Technology and Civil Liberties) deliberation n°2019-053 of 25 April 2019[vii] simplifies and clarifies the texts of 2010 and 2018. The process is as follows:

Choice of security level (1, 2 or 3) according to a questionnaire provided by the CNIL[viii].
Implementation of a test voting platform (iso-production) prior to the elections, with support from the independent expert in the event of questions relating to the conformity of the technical and organisational choices to be made.
Independent assessment of the solution to evaluate the compliance of the solution with the security objectives: depending on the defined risk level, the security objectives are more or less strict. These are cumulative, e.g., if a risk level of 3 is defined, the objectives of levels 1, 2 and 3 must be met.

Decree 2011-595 (public sector)

A regulation has been added to the CNIL deliberation 2019-053 for the public service and certain parastatal sector companies[ix] :

In addition to the CNIL security objectives, 18 articles composing this decree must be respected and checked by the independent expert. The control points include for example:

“At least 2/3 of the keys are allocated to the list delegates and at least 1 key is allocated to the president of the polling station or his representative.”
“The sealing is carried out by the combination of at least 2 encryption keys, including the one of the president of the polling station or his representative and the one of at least one list delegate”
“A process ensures that the voters’ list is only modified by the addition of a ballot electronical paper, which is issued by an authenticated voter casting the vote.”
“Each voter shall be provided at least fifteen days before the first day of the election with a means of authentication enabling him or her to participate in the election – the confidentiality of this means of authentication shall be guaranteed”
“A process ensures that the electronic ballot box (urn) is only modified by the vote of an authenticated voter”

Independent expertise

Obligation

“Any data controller implementing an electronic voting system, in particular via the Internet, must have its solution assessed by an independent expert, whether the voting solution is managed internally or provided by a service provider.” – CNIL Deliberation 2019-053

Modalities

When?

This expertise must be carried out:

Prior to the implementation of the electronic voting system
In the event of a design change to the existing electronic voting system
For every new election using the electronic voting system, even if it has already been audited

By whom?

By an independent expert, who must:

Be an IT (Information Technology) specialist in security
Not having an interest in the company that created the voting solution or in the organisation responsible for processing
If possible, have experience in analysing voting systems, having assessed the voting systems of at least two different providers.

Why?

To ensure compliance with the fundamental principles governing electoral operations:

The secrecy of the ballot
The personal and free nature of voting
The sincerity of the electoral operations
Effective monitoring of the vote by the electoral commission
A posteriori control by the election judge

Typical working approach

Our vision of independent expertise is illustrated by the main steps described in this chapter.

Initialisation and framing

To initiate the mission, a kick-off meeting is organised with the project contacts.

The purpose of this meeting is to introduce the teams, define the milestones and project schedule, specify the service monitoring procedures, the communication procedures between the parties (encryption of exchanges, etc.), collect the existing documentation, and set up the committee procedure.

Audit of the solution and expert support

This central phase of the assessment is based on a theoretical and practical analysis:

Control of project documentation and specifications
- From the “paper” phase onwards, it is necessary to ensure that all the points of compliance are present and in line with the regulations in force: technologies used and updates of the latter, hosting of the solution, physical security, architecture and high availability, partitioning between ballots, sealing and encryption techniques, means of compiling, correlating, communicating and deleting electoral lists, voter authentication scheme, etc.
Support in expertise and safety advice
- This involves providing ad hoc expertise on subjects relating to the legal and regulatory framework during the design and implementation phase of the solution and processes (g., choice of authentication factors, process for storing sealing keys, etc.).
Technical audit of the solution
- Architecture review to check the compliance of physical and logical partitioning, security of flows, hosting, high availability, etc.
- Audit of the organisation and processes such as sealing, authentication communication, archiving, etc.
- Technical configuration review of the key servers of the solution
- Audit of the source code and encryption mechanisms of the solution based, among other security frameworks, on the RGS[x] (Référentiel Général de Sécurité)
- Black-box and grey-box penetration testing of voting portals and the supervision back-office

Observation of test elections

This phase aims to simulate an election to check the correct application of the protocol and the processes verified beforehand on field:

Validation of the compliance monitoring process
- In this step, the aim is to verify that the technique used for the verification of the non-alteration of the system (fingerprinting) works.
Checks on the solution on field
- It is a matter of ensuring, in vivo, that all the points mentioned in terms of security and regulations are in place, for example through the analysis of application and system logs, or “random” checks: presence of temporary files containing sensitive information, capacity to collect data, etc.
Expertise support during the voting process and assistance in adapting procedures in case of unforeseen events

Accompaniment during the actual election

The same checks as during the test elections are carried out, and specifically:

System integrity check: Fingerprinting of essential system components (libraries, code, encryption libraries, etc.) and comparison of the fingerprints with those obtained beforehand.
Compliance with the regulatory framework: sealing process, access, and use of encryption/decryption keys, counting process, etc.

What are the pitfalls and how can they be avoided?

Limited access to systems

The high expertise market context of voting solutions may make vendors reluctant to share confidential information about their technology, such as source code, in the interests of industrial secrecy, which may limit the ability of experts to assess system compliance.

In order to avoid this pitfall, it is essential to implement regular communication and full transparency of the actions of the independent expert. Guarantees must be provided for the protection of the confidentiality of the data collected and processed via processes and an IS certified by SMSI or II 901[xi] (French norm for “Restricted Distribution” classified information).

Furthermore, we recommend that independent experts are flexible in their organisation, for example by agreeing to consult the source code exclusively on the provider’s premises.

Finally, it should be recalled that CNIL deliberation 2019-053 requires the service provider to make available “the source code corresponding to the version of the software actually implemented ” to the independent expert.

Distrust of trade unions and voters

Trade unions and voters can legitimately question the independence of the expert and the guarantees provided by the expertise, leading to mistrust of the electronic voting solution.

These fears are well-founded and must be addressed through transparency and the provision of factual and verifiable evidence for each observation reported during the assessment.

Furthermore, no findings should be ambiguous, conditional, or omitted.

Finally, it is essential to present the limits of the expertise exercise, and the logical impossibility of providing a 100% guarantee that the system cannot be attacked.

Interpretation of the regulations

The available regulations are not always clear and explicit, including

Non-standard architectures are not subject to specific rules
- Ex: An architecture based on an IS straddling the SaaS (Software as a Service) solution publisher and the employer’s IS
Some terms may be ambiguous
- g.: “A voter’s vote must be an atomic operation” – atomicity being a functional rather than a technical notion, e.g., Internet communication protocols do not allow the entire ballot to be contained in a single network packet

The application of security standards and frameworks (such as RGS), direct consultation with the CNIL, and the implementation of a solution that responds to the risk in substance are all ways of remedying this pitfall.

Conclusion and recommendations

To make the most of the independent expertise and to factualise it, we recommend combining the regulatory compliance approach with a risk-oriented approach, based on the technical audit (penetration tests, configuration reviews, etc.) in a logic of practical and pragmatic securing of the solution within the regulatory framework.

This exercise can only be carried out effectively and efficiently if all project stakeholders, including the publisher and trade unions, are involved and made aware of the project as early as the design phase.

Finally, it is necessary to bear in mind that e-voting is a constantly evolving technology. It is likely that new methods and technologies will emerge in the future, leading to an evolution of the regulations. Therefore, technical and regulatory monitoring is and will remain an essential subject for election organisers, publishers, and independent expertise companies alike.

For any information or quotation request on the subject of the independent expertise of electronic voting systems, we invite you to contact us via the following form: https://www.wavestone.com/fr/contact/

We wish you every success in organising your professional elections!

[i] https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000000511691/

[ii]h ttps://www.economie.gouv.fr/elections-professionnelles-2022-quelques-minutes-pour-quatre-annees

[iii] https://fr.wikipedia.org/wiki/Comit%C3%A9_social_et_%C3%A9conomique

[iv]h ttps://www.kercia.com/vote-electronique

[v]h ttps://www.admin.ch/gov/fr/accueil/documentation/communiques.msg-id-37639.html

[vi]h ttps://www.smartmatic.com/fr/actualites/article/lestonie-atteint-des-taux-records-de-vote-par-internet-grace-a-une-nouvelle-technologie/

[vii] https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038661239

[viii] https://www.cnil.fr/fr/securite-des-systemes-de-vote-par-internet-la-cnil-actualise-sa-recommandation-de-2010

[ix] https://www.legifrance.gouv.fr/loda/id/JORFTEXT000024079803/

[x] https://www.ssi.gouv.fr/entreprise/reglementation/confiance-numerique/le-referentiel-general-de-securite-rgs/

[xi] https://www.ssi.gouv.fr/guide/recommandations-pour-les-architectures-des-systemes-dinformation-sensibles-ou-diffusion-restreinte/