E-voting and the UK election: Pick a lizard, any lizard

Estonia, douze points

The poster boy for internet voting is Estonia, where it's been used in parliamentary elections since 2007 (and before that for local elections). Almost a third of votes in the parliamentary election of March this year were cast online. So, it's worth looking in more detail at how it works.

Estonia provides apps for their ID card on Mac, Windows and Linux

Estonia's system relies on the fact that the government provides a lot of services online, and has infrastructure set up for that. Not only does an Estonian national ID card simply identify you to official agencies, but it can also be used to form binding contracts. Connect a card reader to your computer, download an app for Mac, Windows or Linux, and you can digitally sign documents, for example.

Voting over the internet in Estonia – I-voting – is modelled on its postal ballot system, where a sealed envelope containing the secret ballot paper is placed inside another one showing your ID information. This allows the eligibility to be confirmed and the envelope containing the voting paper is removed and then the anonymous ballot is added to the total. In the electronic system, the ballot is encrypted using information from the identity card, which confirms the eligibility to vote.

In practice, you download the voting application and either verify yourself using your ID card in a reader combined with a PIN, or by entering your mobile number, then entering the PIN into the phone after it's received a message from the voting system. That relies on a SIM that includes the Mobile-ID element, effectively linking it to your ID card. And, though the phone can be part of the process, it's not voting by phone itself. Indeed, it's more akin to using it as a two-factor authentication system, alongside the app on the computer.

Estonia's I-voting relies on a desktop app – your mobile is just a two-factor device

Internet voting is possible only during the advance voting period, and you can change your vote as often as you like – the most recent is the one that counts. If you vote at a polling station, that supersedes your I-vote, too.

The system is not without its critics, though. Both the openness of the technology and the potential for mischief caused by cyber-attacks have been cited as flaws in the system, though this is refuted by the country's National Election Committee.

Get Verified

While Estonia's voting system certainly works, things would likely be very different in the UK. For starters, the Estonian system relies on government-issued ID in the form of either an identity card, or a mobile-ID SIM linked to it. Given the strong resistance to such cards in the UK, that in itself is going to be a significant hurdle to creating an online voting system that could be considered secure.

Can you even have online voting without a centralised system of government ID?

We do, of course, have our very own identify verification service, thanks to the work of GDS. Verify has been notable for the chaos it's caused farmers lately, and relies not on a central government system to prove identity, but on third parties. If you can convince Experian you exist, for instance, then that's good enough for Verify. That might be fine when it's a matter of taxing your car, or filling in a form for agricultural subsidies. But should we be making private companies the gateway to our parliamentary democracy?

Even leaving that aside – let's assume for the moment that somehow a UK government was actually able to build the infrastructure to properly verify electronic votes – would it be worth it? And what would be the consequences?