FSFE/fsfe-website
25
31
Fork 91
Code Issues 65 Pull Requests 5 Wiki Activity

Open Letter regarding Internet voting to the National Electoral Committee of the Republic of Estonia

Browse Source 
svn path=/trunk/; revision=26055
This commit is contained in:
Heiki Lõhmus 2013-07-29 15:43:39 +00:00
parent e28ded7be2
commit 1f8d03abb7
2 changed files with 107 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
ee/i-voting/2013-07-26.Open_Letter_to_NEC.en.xhtml Normal file
View File

@ -0,0 +1,53 @@
<?xml version="1.0" encoding="UTF-8" ?>
<html>
<head>
<title>Open Letter on Freedom and Internet Voting to Estonia's National Electoral Committee - FSFE</title>
</head>
<body>
<h1>Open Letter on Freedom and Internet Voting to Estonia's National Electoral Committee</h1>
<p>Dear Sir/Madam,</p>
<p>Subject: <strong>Internet voting in Estonian elections: Issues &amp; Recommendations to Alleviate Concerns</strong></p>
<p>The purpose of this letter is to present concerns regarding the Estonian Internet voting system, and to offer suggestions on alleviating these concerns. We have identified the following areas we would like to comment on below: user freedom and process transparency, mathematics vs trust in people, and dangers inherent to remote voting.</p>
<p><strong>1) User Freedom &amp; Process Transparency</strong></p>
<p>Voting is a crucial process for a democracy, and must therefore not only be conducted as securely and verifiably as possible, but it must also be apparent that the voting process is conducted in this way. Failing to meet this requirement rightfully casts doubt on the legitimacy of the process. Publishing all software, including any and all software running on the election servers and the client side voting application, used in the election process as Free Software<a href="#fn0">⁰</a> (for a list of Free Software licences, please see <a href="#fn1">¹</a>) is a must for a democratic and transparent remote voting system. The recent publication<a href="#fn2">²</a> of the source code to the server applications directly responsible for the voting process was a step in the right direction. However, it was not enough: other software components are involved in the voting process, and these components remain unavailable to the public. The public must also have the ability to verify that other software running on the election servers (the operating system, for instance) is operating as it should.</p>
<p>Furthermore, and perhaps more importantly, the client side software must also be published as Free Software. This would enable voters to verify that the software does exactly what it is supposed to do, alleviating concerns that the client application – at the moment a widely distributed<a href="#fn3">³</a> black box which does not allow a review of its functioning – could be used to distribute spyware. This is a reasonable concern, especially in light of the recent events<a href="#fn4">⁴</a>. More people spotting, reporting and fixing bugs (like the one that affected displaying the names of certain candidates during the parliamentary elections of 2011 and subsequently became subject of the Supreme Court case no. 3-4-1-6-11) and the ability to vote on more platforms (although this would be properly resolved by basing the client application on widely supported Open Standards<a href="#fn5">⁵</a>) would be additional advantages.</p>
<p>In order to realise these advantages, it is also imperative that the software is released as Free Software (the CC-BY-NC-ND licence the server side software is currently released under does not qualify as a Free Software licence). Merely being able to look at the source code does not enable researchers and citizens to fix bugs, develop better versions of the software, or otherwise adapt it to their needs. It also sends the wrong signal in that it places undue restrictions on how the public can interact with software developed with public funds. Furthermore, the development process of the voting software should be opened up to public participation in order to properly leverage the public's ability to provide testing, bug reports and patches. Voting is a collective, public process, so why should the development of voting software be any different?</p>
<p>Wherefore, we respectfully request that the NEC publish all software used in the elections process, including any and all software running on the election servers, as Free Software and enable public participation in its future development.</p>
<p><strong>2) Maximising Reliance on Mathematics</strong></p>
<p>As cryptography is outside our core area of expertise, we will not make specific recommendations in this field. However, it seems to us that the current system relies quite a bit on the integrity of the people organising elections, opening the door to potential accusations of electoral fraud. We would recommend investigating ways to reduce the reliance on the integrity of people in favour of mathematically proven techniques.</p>
<p><strong>3) Dangers Inherent to Remote Voting</strong></p>
<p>Voting via Internet opens up opportunities for increased citizen participation. Yet these opportunities come at the cost of increased reliance on technical processes, which must be designed with the utmost care for security and the highest priority for transparency in order to ensure that elections remain credible.</p>
<p>Any kind of remote voting system must have a mechanism in place to deal with voter coercion. While the Estonian system mitigates this by enabling the voter to change his or her vote during a set period of time, the mitigation strategy assumes that the voter knows s/he is being coerced, and is willing and able to change their vote later.</p>
<p>The ability and willingness to resist coercion may or may not exist in the majority of cases where knowledge of coercion exists; however, they must be lacking in scenarios where the voter has no knowledge of the subversion of their will. Hence, compromised client machines should be a major concern. At the very least, the NEC should take steps to publicise the dangers as widely as possible, along with instructions to minimise the risk and rectify the situation should a risk realise.</p>
<p>Thank you for your attention. We remain available to discuss these important issues with you, and are looking forward to your response, which we would like to receive electronically at [[redacted]].</p>
<p>
Faithfully yours,<br />
Heiki Ojasild<br />
Fellowship Representative
</p>
<p id="fn0"><a href="https://fsfe.org/about/basics/freesoftware.html">https://fsfe.org/about/basics/freesoftware.html</a></p>
<p id="fn1"><a href="http://opensource.org/licenses/alphabetical">http://opensource.org/licenses/alphabetical</a></p>
<p id="fn2"><a href="http://news.err.ee/politics/0233b688-b116-44c3-98ca-89a4057acad8">http://news.err.ee/politics/0233b688-b116-44c3-98ca-89a4057acad8</a></p>
<p id="fn3">According to the official statistics found at <a href="http://vvk.ee/voting-methods-in-estonia/engindex/statistics/">http://vvk.ee/voting-methods-in-estonia/engindex/statistics/</a>, 140 846 people, or 24.3% of participating voters, cast their vote over the Internet in the parliamentary elections of 2011.</p>
<p id="fn4"><a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data">http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data</a></p>
<p id="fn5"><a href="https://fsfe.org/activities/os/def.html">https://fsfe.org/activities/os/def.html</a></p>
</body>
</html>

54
ee/i-voting/2013-07-26.Open_Letter_to_NEC.et.xhtml Normal file
View File

@ -0,0 +1,54 @@
<?xml version="1.0" encoding="UTF-8" ?>
<html>
<head>
<title>Avalik kiri vabadusest ja Interneti-hääletusest Vabariigi Valimiskomisjonile - FSFE</title>
</head>
<body>
<h1>Avalik kiri vabadusest ja Interneti-hääletusest Vabariigi Valimiskomisjonile</h1>
<p>Lugupeetud härra või proua</p>
<p>Teema: <strong>Interneti-hääletus Eesti valimistel: probleemid ja soovitused nende leevendamiseks</strong></p>
<p>Käesoleva kirja eesmärgiks on tuua välja mõned probleemid Eesti Interneti-hääletuse süsteemis ning pakkuda lahendusi nende leevendamiseks. Oleme välja valinud järgnevad valdkonnad, mille kohta soovime teha allpool mõned märkused: kasutaja vabadus &amp; hääletamisprotsessi läbipaistvus, usaldus matemaatika <i>vs</i> inimeste vastu ja kaughääletamisega kaasnevad ohud.</p>
<p><strong>1) Kasutaja vabadus &amp; hääletamisprotsessi läbipaistvus</strong></p>
<p>Hääletamine on demokraatia seisukohast kriitiline protsess, mistõttu ei tule seda mitte ainult läbi viia nii turvaliselt ja verifitseeritavalt kui võimalik, vaid asjaolu, et hääletamist viiakse läbi just sellisel moel, peab olema nähtav ka väljapoole. Selle nõude täitmata jätmine seab õigustatult kahtluse alla protsessi legitiimsuse. Demokraatliku ja läbipaistva kaughääletamissüsteemi eelduseks on kogu valimistel kasutatava tarkvara, kaasa arvatud kogu valimisserveritel jooksva tarkvara ning kliendipoolse hääletamisrakenduse, avaldamine vaba tarkvarana<a href="#fn0">⁰</a> (viite nimekirjale vaba tarkvara litsentsidest leiab allmärkusest <a href="#fn1">¹</a>). Hiljuti avalikustas<a href="#fn2">²</a> VVK otseselt hääletamisprotsessiga seotud serverirakenduste lähtekoodi. Tegu oli sammuga õiges suunas, ent see polnud piisav: hääletamisprotsessiga on seotud veel tarkvarakomponente ning need komponendid pole endiselt üldsusele kättesaadavad. Avalikkusel peab olema ka võimalus veenduda, et muu valimisserveritel jooksev tarkvara (näiteks operatsioonisüsteem) töötab õigesti.</p>
<p>On ehk olulisemgi, et valijarakendus avaldataks vaba tarkvarana. Nii saaks valija kontrollida, et valijarakendus teeb täpselt seda, mida ta tegema peaks. See leevendaks kartusi, et valijarakendust võidakse kasutada nuhkvara levitamiseks – hetkel on tegu laialt levinud<a href="#fn3">³</a> musta kastiga, mille valijapoolne kontroll pole võimalik. Hiljutiste sündmuste<a href="#fn4">⁴</a> valguses on tegu mõistliku murega. Lisaeelisena näeme, et vigu (nagu näiteks see 2011. aasta Riigikogu valimistel mõne kandidaadi kuvamist mõjutanud viga, mida arutas hiljem Riigikohus asjas nr 3-4-1-6-11) märkaks, neist teavitaks ning neid parandaks rohkem inimesi; ka suureneks hääletamist võimaldavate platvormide hulk (õigem oleks siin küll valijarakendus rajada laialdaselt toetatud avatud standarditele<a href="#fn5">⁵</a>).</p>
<p>Eelkirjeldatud eeliste realiseerumiseks on nõutav, et tarkvara avaldatakse vaba tarkvarana (CC-BY-NC-ND litsents, mida kasutatakse hetkel serverirakenduste avaldamisel, ei kvalifitseeru vaba tarkvara litsentsina). Võimalus lähtekoodiga vaid tutvuda ei võimalda teadlastel ja kodanikel vigu paranda[da], tarkvarast paremaid versioone arendada ega seda muul moel enda vajadustele vastavaks kohandada. Lisaks saadab see vale signaali, piirates sobimatult võimalusi, mil üldsus võib suhestuda avalike vahenditega arendatud tarkvaraga. Lisaks tuleks tarkvara arendusprotsess üldsusele avada, et paremini ära kasutada avalikkuse võimekust tarkvara testida, veateateid edastada ning koodipaiku pakkuda. Hääletamine on kollektiivne, avalik protsess – miks peaks hääletamistarkvara arendamine teistsugune olema?</p>
<p>Eeltoodud põhjustel palume lugupidavalt, et VVK avaldaks kogu hääletamisprotsessis rakendatava tarkvara, kaasa arvatud kogu valimisserveritel jooksva tarkvara, vaba tarkvarana ning võimaldaks üldsusel osaleda selle tulevases arenduses.</p>
<p><strong>2) Maksimaalne toetumine matemaatikale</strong></p>
<p>Krüptograafia jääb meie põhikompetentsist väljapoole, mistõttu ei esita me selles vallas täpseid soovitusi. Küll aga tundub meile, et praegune süsteem toetub tugevalt valimisi korraldavate inimeste aususele, jättes seeläbi võimaluse süüdistusteks valimispettuses. Me soovitame uurida lahendusi, mis vähendavad süsteemi sõltuvust inimeste aususest, tuginedes selle asemel matemaatilistele tõestustele.</p>
<p><strong>3) Kaughääletamisega kaasnevad ohud</strong></p>
<p>Interneti teel hääletamine võimaldab suuremat kodanike osalust. Ent sellel on oma hind – suurem toetumine tehnilistele protsessidele, mis peavad olema disainitud ülima hoolega turvalisust silmas pidades ning suurimat võimalikku läbipaistvust taotledes, et kindlustada valimiste jätkuv usaldusväärsus.</p>
<p>Igasugusel kaughääletamissüsteemil peab olema mehhanism valijasunniga (ing k <i>voter coercion</i>) tegelemiseks. Eesti süsteem leevendab seda probleemi, võimaldades valijal enda häält etteantud ajavahemiku jooksul muuta. See strateegia eeldab, et valija on sunnist teadlik ning tahab ja suudab oma häält hiljem muuta.</p>
<p>Võime ja tahe sunnile vastu seista võib enamikul valijasunni juhtudest olla olemas või mitte, kuid võimet ega tahet sunnile vastu seista ei saa esineda juhtudel, kus valija ei tea, et tema tahet arvesse ei võeta. Seetõttu peaksid olema hääletajate kompromiteeritud masinad üks suur murekoht. Vähim, mida VVK tegema peaks, on need ohud võimalikult laialdaselt teatavaks teha koos juhistega, kuidas mõne riski realiseerumise korral toimida.</p>
<p>Täname teid tähelepanu eest. Me oleme saadaval, et neid olulisi küsimusi Teiega edasi arutada, ning jääme ootama Teie vastust, mille palume saata elektronpostiga aadressile [[välja jäetud]].</p>
<p>
Lugupidamisega teie<br />
Heiki Ojasild<br />
Fellowship Representative
</p>
<p id="fn0"><a href="https://fsfe.org/about/basics/freesoftware.html">https://fsfe.org/about/basics/freesoftware.html</a></p>
<p id="fn1"><a href="http://opensource.org/licenses/alphabetical">http://opensource.org/licenses/alphabetical</a> (ing k)</p>
<p id="fn2"><a href="http://uudised.err.ee/index.php?06283207">http://uudised.err.ee/index.php?06283207</a></p>
<p id="fn3">VVK ametliku statistika (<a href="http://vvk.ee/valijale/e-haaletamine/e-statistika/">http://vvk.ee/valijale/e-haaletamine/e-statistika/</a>) kohaselt hääletas 2011. aasta Riigikogu valimistel 140 846 inimest ehk 24.3% kõigist hääletanutest Interneti teel.</p>
<p id="fn4"><a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data">http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data</a> (ing k)</p>
<p id="fn5"><a href="https://fsfe.org/activities/os/def.html">https://fsfe.org/activities/os/def.html</a></p>
</body>
<translator>Repentinus</translator>
</html>