Letter to Michael McDowell about online voting

Dear Mr. McDowell,

I received your materials outlining your priorities for Seanad Éireann and was dismayed to learn that you advocate “online voter registration and voting”.

Voting in Seanad Éireann elections is at present conducted by means of a postal ballot. Postal voting already presents a variety of serious threats to the confidentiality and integrity of the ballot. Online voting would solve none of these problems, exacerbate most of them, and introduce some new and unique problems of its own.

The most obvious and most serious risk is that the possibility that the computer used by the voter has been compromised by malicious software (malware). This is no idle speculation: a 2015 Microsoft report suggests that over 12% of computers in Ireland contain malware or unwanted software. With a postal ballot, the threat of interception of one’s ballot paper is largely limited to one’s cohabitants and the postal service. With online voting it is expanded to include technically skilled adversaries from anywhere in the world, and indeed anyone able to use tools developed by such individuals.

In addition to the risk of compromise of the voter’s personal computer, there is the risk of compromise of the Internet service accepting votes. Such a system would be a high-value target, both for silent compromise with a view to tampering with the election results, and for “denial of service” attacks intended to prevent voters (or worse, particular subsets of voters) from accessing the voting service.

Thus, in common with postal voting, online voting provides no strong guarantees of secrecy, voter anonymity, or integrity of the ballot, and no protection at all against voter intimidation or vote buying. In addition, online votes are likely to be counted electronically, bringing all the problems of unverifiable black-box counting machines that we all remember from the disastrous attempts to introduce electronic voting in 2004. As I have previously said elsewhere, we dodged a bullet when those attempts failed, and we don’t need another bullet to dodge.

Certainly, reform of the voting process in Seanad Éireann elections is sorely needed. The correct approach would be to align it with the existing processes for Dáil Éireann, local authority, European Parliament and presidential elections. This process, while admittedly imperfect, would be a considerable improvement.

I urge you to reconsider your position on this matter.

Yours sincerely,
John Morahan