What is the future of electronic vote in France - Recommendation of Le Forum des droits sur l’internet

The Internet rights forum

26 September 2003

CONTENTS

SUMMARY OF RECOMMENDATIONS................................................................. 4

FINDINGS AND PROBLEMS........................................................................ 9

1.1.

Electronic voting methods and the scope of the recommendation ................. 9

1.1.1.

Electronic voting methods ................................................................. 9

1.1.2.

The scope of the recommendation ...................................................... 9

1.2.

Advantages and risks linked to the introduction of electronic voting ............ 10

1.2.1.

Anticipated advantages of electronic voting........................................ 10

1.2.2.

Risks linked to the introduction of electronic voting ............................. 12

1.2.3.

The cost of electronic voting ............................................................ 15

1.3.

Initial assessments of electronic voting experiments ................................. 16

1.3.1.

Experiments with electronic voting for political polls ............................ 17

1.3.2.

Experiments with electronic voting for local consultations .................... 20

1.3.3.

Experiments with electronic voting within professional orders and

associations. ............................................................................................ 21

1.3.4.

Experiments with electronic voting for professional polls ...................... 22

PRINCIPLES AND PLAN OF ACTION FOR THE ROLLOUT OF ELECTRONIC

VOTING ........................................................................................................ 24

2.1.

Electronic voting rollout principles.......................................................... 24

2.1.1.

Plan for gradual electronic voting rollout............................................ 24

2.1.2.

Public authorities to retain their role for public polls ............................ 24

2.1.3.

Allowing electronic distance voting when postal voting is already in

existence ................................................................................................. 25

2.1.4.

Envisaging electronic distance voting as an additional method of voting . 26

2.1.5.

Organising electronic voting around the main players in the election ..... 26

2.2.

The action plan for the rollout of electronic voting .................................... 26

2.2.1.

For political elections ...................................................................... 27

2.2.2.

For ‘prud’homale’ elections .............................................................. 28

2.2.3.

For ordinal and consular elections..................................................... 29

2.2.4.

For professional elections ................................................................ 29

2.2.5.

For elections within associations, general shareholders’ meetings and

public service user consultations ................................................................. 30

PRACTICAL, TECHNICAL AND LEGAL PROCEDURES FOR THE ROLLOUT OF

ELECTRONIC VOTING.................................................................................... 31

3.1.

The declaration to the ‘Commission nationale de l'informatique et des libertés’31

3.2.

Electronic management of the electoral roll ............................................. 31

3.3.

Voting security.................................................................................... 32

3.4.

Voter authentication solutions ............................................................... 33

3.5.

Voting confidentiality and sincerity requirements...................................... 34

3.6.

Electronic voting rollout........................................................................ 35

3.6.1.

Electronic voting operations............................................................. 35

3.6.2.

Determining special procedures for electronic distance voting............... 37

3.7.

Encouraging voters to take the electronic voting system on board and have

confidence in its operation. ........................................................................... 38

3.7.1.

The ergonomics of the electronic voting system must be studied so as to

make voting as simple as possible for users.................................................. 38

3.7.2.

Surrounding electronic voting with a certain solemnity and providing for

voting confirmation ................................................................................... 38

3.7.3.

Supporting election players whilst electronic voting is implemented....... 38

3.8.

Encouraging checks on voting operations ................................................ 38

3.8.1.

Enabling the integrity of the voting system to be monitored ................. 38

3.8.2.

Providing for storage of voting data .................................................. 39

The Internet rights forum

26 September 2003

SUMMARY OF RECOMMENDATIONS

I. Principles for the rollout of electronic voting

The Internet rights forum believes that a number of principles should surround the rollout of
electronic voting.

Electronic voting should be introduced

, but

in a gradual and reasoned manner

The

public authorities must continue to be in charge of the design and

operation of the polls that they are responsible for organising.

Electronic distance voting must be possible where provision has been made for
postal voting

, provided that the players in question are in favour of said means of

voting.

Electronic distance voting must be designed as a supplementary voting

procedure and should not exclude more traditional methods

in the name of the

principle of voting equality for all citizens.

For political elections,

the main electronic voting development phases must first

be the subject of widescale public debate

II. The rollout of electronic voting must be gradual and reasoned

The Internet rights forum recommends that electronic voting should not be introduced in a
uniform manner. Decisions should be taken on a poll by poll basis. The Forum recommends the

following plan of action:

- For political elections:

Electronic distance voting should not be introduced.

On the other hand, the Forum

wishes

each voter to be able to vote at a voting kiosk in any polling station.

It should be possible to experiment with

electronic distance voting during local

referendums.

It should be possible for

all French nationals abroad

to use

electronic distance

voting for ‘Conseil supérieur des Français de l’étranger’ [Supreme council of
French nationals abroad] elections.

The State must undertake to bear the specific cost of electronic voting system
equipment

- For ‘prud’homale’ elections [‘prudh’hommes’ are nonprofessional magistrates who oversee

contract disputes in a court system set up according to region and industry. Half of the
delegates are nominated by labour unions and elected by workers, and the other half are

nominated and voted upon by business owners]:

Voting at a voting kiosk in any polling station

must be introduced for

‘prud’homale’ elections.

The Forum recommends that

electronic distance voting experiments

should be

conducted during the next ‘prud’homale’ elections for the employers’ board, and,
indeed, for the management section of the employees’ board.

The Internet rights forum

26 September 2003

- For ordinal and consular elections:

Electronic distance voting

must be set up for

elections to professional orders,

and chambers of commerce, industry, trade and agriculture

, subsequent to

approval from the organisations in question.

- For professional elections:

In the private sector:

electronic distance voting or voting at a voting kiosk

should be authorised

. To do this, it will be necessary to amend labour law provisions.

The choice of voting procedure must be subject to prior agreement between

management and labour.

In the public sector:

electronic distance voting should be authorised for elections

inside public sector joint administration committees and joint technical
committees,

subsequent to agreement between management and labour.

- For voting inside associations, general shareholders’ meetings and for public service user

consultations:

The development of distance voting should be encouraged within associations
and general shareholders’ meetings

, in particular, by promoting exchanges of

experience between players.

Consultations and electronic distance voting should be developed for public

service users

. This may initially be applied within the sector of school parent

representative, or student representative, elections.

III. Electronic voting must be rolled out in accordance with a number of practical
procedures

The introduction of electronic voting cannot be envisaged unless certain practical procedures
are respected:

Electoral roll management must be modernised

. For this, the Forum recommends that

electoral rolls should be managed electronically in the form of a national voter file.

The level of

authentication

required must be

in proportion to the importance of the

poll

. Thoughts regarding

voter authentication must be taken into account in the “Daily

life card” and “electronic identity card” projects

Any system of electronic voting used for a public poll

must be subject to

technical

approval

from the relevant ministry, granted on the basis of

specifications

. The

specifications must adhere to the following rules:

Strict separation

of the duties of the electoral roll manager and those of the electronic

urn manager.

Access to source code

by approved experts.

“A posteriori”

audit

of the voting system.

Voting data

to be stored until expiry of deadlines for judicial appeals instead of reports

being stored.

The Internet rights forum

26 September 2003

Voting system servers to be located

on national territory.

- Special electronic distance voting procedures:

It must be possible for

electronic distance voting

to take place over several days

and the deadline for voting electronically must be prior to the voting date at polling
stations.

Electronic votes must be final votes.

Although taking place over several days, it

must not be possible to modify the electronic vote once it has been cast. It must not,

therefore, be possible for this vote to be substituted by a vote placed in the urn on the
day of the election nor by a postal vote.

Electronic voting must be surrounded by a certain solemnity:

the vote cannot be

made final until it has been confirmed twice by the voter who must always be entitled,
provided that the vote has not been confirmed, to change his/her mind about the way
he/she intends to vote.

The introduction of electronic voting must be accompanied by information and

training initiatives

. Digital public spaces as well as National Education must

encourage these initiatives devoted to information technology and citizenship training.

Electronic votes conducted for public polls

must be the subject of special

follow-up

and

evaluation procedures

The Forum recommends the

creation, within the Agency for the

development of electronic administration, of an electronic voting ‘Observatory’

The Observatory would have the following duties:

To centralise information and lessons learnt from electronic voting

experiments

and to conduct

international research

;

To give

ministries the benefit of its expertise during the approval of voting

systems

evaluate electronic voting systems

To report on its activity

by means of publishing an annual report.

The Internet rights forum

26 September 2003

INTRODUCTION

Voting is a democracy’s main means of expression. It exists in all spheres of society i.e. within

associations and companies, between peers within the same profession and, of course, at a
political level.

It seems that the development of information technologies will be able to change the face of
voting and voting procedures. Although electronic voting has been in existence for many years

now, in the form of the voting machine, the development of the internet has opened up a new
field of expression by enabling distance voting. In this respect, the organisation of an internet

vote, in Arizona, in March 2000, to appoint the democrat candidate for the presidential
elections was, for some people, the start of a new form of democratic expression. Lots of

countries, such as the United States, Belgium, Germany, the United Kingdom and even Estonia
are experimenting with, or even legalising, electronic voting.

In addition to the anticipated management advantages linked to the introduction of electronic
voting (instant analysis, lower costs etc.) there are arguments relating to greater simplicity

and comfort for voters. Generally speaking, a renewed enthusiasm for citizenship is expected
due to the introduction of information and communication technologies and the new forms of

direct debate, expression and consultation that they make possible.

For all that, the introduction of electronic voting raises lots of questions. For some, polling
security, confidentiality and sincerity are principles which seem to have been brought into
question by electronic voting. Others stress the importance of economic factors caused by

these new markets, the importance of which should not justify adoption without discussion of
solutions adopted by other countries. Generally speaking, the specific nature of national

cultures must be kept in mind since this may translate into different relationships with voting
and its principles.

Having considered this contradictory understanding of voting, we must ask ourselves if France

should follow the general trend which is in favour of electronic voting. Although two recent
laws have just introduced the possibility of voting electronically for some elections, it is
particularly important to conduct a critical analysis of the costs and benefits of electronic

voting. Voting remains, in effect, a symbolic act, a ritual which lays the foundations for
belonging to a social and political community. Any change in its procedures must, therefore, be

reflected upon maturely, without excessive distrust or enthusiasm.

The Internet rights forum wanted to seize upon this question, thereby continuing with work
already begun on electronic democracy within the scope of its August 2002 recommendation

on the webcampaign. It set up a working party on 5 February 2003. The recommendation that
follows was adopted on 22 September 2003 by the Forum’s Steering committee.

Objectives and report plan

The aim of the working party was first of all to compile a report (I) on the advantages and

risks of the various electronic voting methods. This consideration was, in particular, based on a
critical analysis of the different experiments already conducted in France, as well as on an

international comparison.
The working party also wanted to draw up an action plan (II) to be sent to public authorities
and players involved in electronic voting. This plan aims at a gradual rollout of electronic

voting for different polls.

The Internet rights forum

26 September 2003

FINDINGS AND PROBLEMS

1.1.

Electronic voting methods and the scope of the recommendation

1.1.1.

Electronic voting methods

The notion of electronic voting can be understood in the widest sense. It could, for example,

include electronic counting of ballot papers. The recommendation does not, however, tackle
this aspect of electronic voting and only deals with the case where the voter votes in a

dematerialised manner by electronic means. It does not, therefore, deal with analysis by
barcode or ballot papers read using a scanner.

Electronic voting can use very different methods.

Voting at a voting kiosk inside the voter’s polling station.

The voter votes from a terminal, the voting kiosk, inside his/her usual polling station. In

principle, therefore, he/she no longer uses a paper voting slip. The system automatically

counts the votes inside the polling station.

Voting at a voting kiosk in any polling station.

The voter must go to a polling station in order to be able to vote but he/she may go to

any polling station within the territory. The voter’s identity and his/her entry into the voting
cubicle may, if necessary, be monitored by staff at the polling station. The system must,

however, make it possible to check that the voter is properly authorised to vote. It must
also, if necessary, transfer the information to the voter’s usual polling station.

Voting at a voting kiosk not inside a polling station.

The voter votes using a machine that is positioned in a specific location but is not

monitored by a polling station. And so it is possible to imagine voting at a terminal inside a
shopping centre, a station or a post office.

Distance voting without the voter having to go to the polls.

Voting can take place anywhere at all. The voter may, therefore, vote from his/her

home, his/her place of work or from any other point within the territory. The technologies

used may be very different:

internet voting from a computer

voting by SMS (Short Message Service) on a mobile telephone

voting by telephone using the telephone keypad

voting by means of interactive television

This recommendation refers to electronic voting by means of these four methods.

1.1.2.

The scope of the recommendation

This recommendation does not intend to limit itself to political voting and local or national

elections or referendums.

Certainly, the political vote is the most sensitive and demands particular attention. For all that,

there are other types of polls that may be affected by electronic voting:

Professional elections within companies (works councils, employees’

representatives) or within government

‘prud’homale’ elections

The Internet rights forum

26 September 2003

consular elections

elections within professional orders

- voting at general shareholders’ meetings

university elections

professional elections within the civil service within joint administration committees

and joint technical committees

voting within associations

This recommendation has used the term ‘public poll’ for political and ‘prud’homale’ elections.

1.2.

Advantages and risks linked to the introduction of electronic voting

1.2.1.

Anticipated advantages of electronic voting

1.2.1.1. Advantages in terms of vote management

•

Improved processing and analysis

In principle, the use of electronic voting means improved processing and analysis. It gives an
exact count of votes cast. It means that the results from polling stations and at a central level

can be obtained very rapidly. It means, therefore, gains in terms of mobilisation of personnel
and voluntary workers.

•

Limitation of errors relating to polls using paper votes and frauds

Electronic voting means that uncertainties relating to invalid votes (marked, torn, folded votes
etc.) which can be found in the current system can be eliminated together with annoying

multiple irregularities which are not always of a fraudulent nature.

Electronic voting also means that various frauds that may come to light during a paper ballot
can be prevented (envelopes thrown away, urns jammed etc.).

•

Blank votes can be counted

This advantage is in addition to the previous one. A blank vote is defined as a vote where the
voter does not designate any candidate

. During a paper vote, blank votes are counted as

cancelled votes and cannot be distinguished from invalid ballot papers.

The question of knowing whether blank votes should be officially taken into consideration is,
what’s more, a matter for debate. For political elections, a recent bill was aimed at enabling

blank votes to be precisely defined and to be distinguished from invalid ballot papers.
Nevertheless, some people believe that recognising a blank vote would be liable to falsify

election logic due to the possibility of voters casting a vote of no confidence rather than a
positive choice.

This democratic debate exceeds the aim of this recommendation. At this stage, it is only
necessary to note that a decision to count blank votes would be facilitated by the introduction

of electronic voting systems.

1.2.1.2. Advantages in terms of participation

For political elections, this definition is given in article L.57-1 of electoral law. It is specified therein that voting using

a voting machine enables

“blank votes to be recorded”

Bill

for the recognition of blank votes in elections

adopted by the National Assembly at first reading on 30 January

2003.

The Internet rights forum

26 September 2003

The main argument in favour of electronic voting away from the voter’s polling station would

lie in the growth in electoral participation. Three positive factors can be expected from the
introduction of electronic distance voting:

- It would be possible to vote in places other than the polling station assigned to the voter and

so would facilitate the act of voting. By doing so, voting would be more in line with recent
lifestyle and work trends which have, in particular, been characterised by ‘nomadism’ and a
growth in occupational mobility.

- It may facilitate voting for populations which may encounter difficulties in having to leave

home in order to vote at their polling station i.e. this is the case for those living alone who are
elderly or disabled.

- It may encourage young voters to participate since they are regular users of information

technologies and will find this new way of voting a more modern participation tool, even if
surveys so far have not shown that these voters would be more motivated if they had these
tools at their disposal.

Of course, the low participation rate in some polls does not just relate to physical voting
conditions and how hard it is to vote. Some voters have turned away from the polls, both

political and social and professional, more due to distrust of their representatives or due to a
lack of interest in what is at stake in the election than for practical reasons. Abstention may

also be explained by social exclusion. In this respect, electronic voting would hardly be likely to
have an impact on the participation of this population of voters and may even make voting

more difficult for them.

For all that, the results of electronic voting experiments conducted in France within a private

framework or alongside political elections seem to indicate a slight tendency towards a rise in
participation (cf. part 1.3). The fact, however, that these experiments are dealing with smaller

populations and are only based on volunteers voting without anything really being at stake
(the poll only having consultative worth), prevents this finding from being strictly validated.

In France, the results of an experiment conducted on a significant sample, that of the vote for

the CSFE [Supreme Council of French Nationals Abroad] (cf. 1.3.1.3.), demonstrated that the
introduction of electronic voting slowed the drop in the rate of abstentions by stabilising
electoral participation; although this could be seen in other wards that were comparable in

terms of size and type of electorate.

In a country like the United Kingdom, the results of pilot elections in 2003 showed that it is
difficult to draw clear and direct information regarding the relationship between electronic

voting and electoral participation (cf. 1.3.1.4.).

For the moment, therefore, it is not possible, in the light of electronic voting experiments, to
confirm that electronic voting increases participation or, conversely, that it has no effect on
participation.

1.2.1.3. Advantages in terms of renewed enthusiasm for citizenship

•

The modernisation of public life

Being able to vote electronically seems like a symbol of the modernisation of public life and

corresponds to trends in a society that is more mobile and more demanding in respect of the
services to be supplied by the authorities. It would support the expansion of information

The Internet rights forum

26 September 2003

technologies and their use by voters. It may seem normal, for voters who increasingly sue

information technologies in their daily lives, to be given this opportunity for voting in certain
polls. Since it is possible to vote by SMS or by phone within the scope of game shows and

reality TV programmes, it is tempting to think that the same opportunity should be offered for
the organisation of some polls.

•

The appearance of new forms of citizen participation

Electronic distance voting via internet would enable other forms of political involvement and
interaction to be stimulated by giving voters a new means of exchanging their opinions. Voting

may, therefore, be accompanied by the creation of new forms of citizen expression. It is
possible to create debates and consultations around electronic voting (discussion forums,

surveys or on-line public enquiries, virtual symposiums etc.

For some, the internet may enable voters to be consulted more frequently or, indeed, semi-
permanently. It is, therefore, possible to imagine that a union would systematically consult its
members by electronic means regarding agreements signed or positions taken. For others,

distance voting confirms the role of the representative by reinforcing the representative nature
of those who have been elected, who may, in this way, make sure, on a regular basis, that

they are consistent with their voters.

In their analysis of trends in political practice in the digital age, Stephen Coleman et John
Gotze

draw the idea, from lots of European voting and on-line deliberation experiments, that

only one model of deliberative democracy combining deliberation and voting practices may be
likely to remedy European citizens’ growing ‘apathy’. In their eyes, therefore, electronic voting
constitutes the first step towards the dissemination of consultation practices that do not

necessarily have to take the form of an election but which would come to support and assist
elected representatives in their daily tasks.

Electronic voting means, therefore, that democratic practices can be renewed by encouraging a

form of direct democracy enabling citizens to act in a concrete and rapid fashion in public life.

Some do, however, believe that voters are weary of these new forms of participation and that
the latter will lead to a desacralization of the very concept of voting (saturation of information,
too frequent consultations etc.). Because of this, the act of wishing to encourage these forms

of direct expression could affect the very principle of representative democracy.

1.2.2.

Risks linked to the introduction of electronic voting

The risks vary according to the electronic voting method used.

1.2.2.1. Risks common to all electronic voting systems

•

System security problems

Different electronic voting systems may be the subject of various forms of attack or

fraud attempts, particularly when they are based on data centralisation.

Of course, as indicated above, voting using paper media is not exempt from fraud. The

use of computers for electoral operations would, however, under certain circumstances, permit
large-scale fraud by just a handful of fraudsters.

For example, Greece, which presided over the European Union from January to July 2003, asked netsurfers to give

their points of view on broad guidelines for European policy by means of multiple choice questionnaires
(

www.evote.eu2003.gr

Stephen Coleman and John Gotze,

Bowling together. Online Public engagement in Policy Deliberation

. London,

Handsard Society, 2002.

The Internet rights forum

26 September 2003

It is necessary to distinguish between two sets of circumstances:

1) When electronic voting is performed on isolated terminals, i.e. physically in voting kiosks

inside polling stations, the risk is limited to denaturation of the voting system by ‘a priori’ local
means. This mainly consists of the modification of all, or part, of the management and

processing software:
- electoral lists
- voting documents

- ballot papers
- presentation of the results of the poll

This risk can be reduced, in particular, by checking the system used and by measures ensuring

the integrity of the system during electoral operations.

2) The risks would appear to be greater when electronic voting involves the transfer of data by
means of a network to a server centralising the results. The use of a network infrastructure
opens the system up to other types of attack and fraud, especially if the architecture uses an

internet-type open system. It may also enable a small number of individuals to falsify the
result of the whole poll, something which would appear to be more difficult when the data is

being handled by individual polling stations.

We can, therefore, distinguish between:

- Attacks upon the transmission system: breakdown in physical transmission media (cutting of
cables or fibre optics), saturation of media by massive transmission of fictional data packets,
malicious eavesdropping of data communications, pirate network connections.

- Attacks on servers: refusal of service

consisting of unauthorised access to server functions,

server access saturation (

flooding

*) by transmission of non compliant data packets

(information packets are too large), takeover of machines enabling fraudsters to act as system

administrators (

Trojan horse

* type viruses).

- Attacks on polling stations: unauthorised assumption of identity (

spoofing

*) enabling

fraudsters to act in place of a voter or to multiply the latter’s voting actions, diversion of

electoral site access to another address where it becomes possible to capture the parameters
entered by the voter, installation of ‘malicious’ commands or viruses enabling the poll to be

controlled (capture or modification of parameters, diversion of transactions).

Nevertheless, it is necessary to specify that the risk of external attack on electronic voting

systems varies according to the sensitivity of the poll. Consequently, the level of security
inherent in an electronic voting system used for a major political election would have to differ

from that used for an election within a professional order.

•

Impairment of the sincerity of the vote and voting secrecy

Risks relating to manipulation of the meaning of suffrage would appear to be much greater
with electronic voting than with paper voting.

When a ballot paper is placed in an urn, there are no intermediaries between the will of the
voter and the expression of his/her vote. There is nothing to physically prevent the voter’s

ballot paper from being substituted or corrected (urn jamming) but the urn represents a
guarantee of transparency since the process is visible to all.

On the other hand, electronic voting interposes an opaque computer system between the voter

and his/her ballot paper. This sense of the existence of a "black box" that cannot be seen by

The technical terms used in this section, and which are more fully defined in the glossary, are followed b an asterisk.

The Internet rights forum

26 September 2003

the voter may engender distrust of the electronic voting system in some people who may

doubt the fact that their choice of vote has really been taken into consideration without
upstream denaturation by the voting system or has not been modified by ill-intentioned

candidates.

Likewise, the use of an electronic voting system may enable the identity of the voter to be
linked to the way that he/she has voted. There may, then, be fears that an ill-intentioned
candidate or agent responsible for monitoring the vote, without talking about a third party

hacking into the system, may link the voter’s identity with his/her vote.

This risk appears to be excluded for traditional polls. The passage through the cubicle and the
placing of the ballot paper in the urn seems to protect the voter against the risk of anyone

knowing the way in which they are voting. This protection appears to be reduced when using
computer systems.

1.2.2.2. Specific risks for electronic voting away from polling stations

•

Pressure on voters

Voting inside a polling station is monitored by assessors and candidate representatives. This

means that a watch can be kept to ensure that no pressure is placed on the voter when he/she
places his/her ballot paper in the urn. The journey from the cubicle guarantees that the vote is

secret. These principles, appearing as article 3 of the Constitution, article 3 of the first
additional protocol to the European convention for the protection of human rights and

fundamental freedoms and also appearing in the electoral law

, remain vital.

In the case, however, of electronic voting away from the polling station, these basic principles

would appear to be less solidly guaranteed. It is more difficult to ensure the confidentiality of
the vote and that no pressure has been brought to bear on the voter, either by his/her family

entourage or within his work community or of any other kind.

The objection can, of course, be raised that voting in a cubicle does not exclude the existence
of family or social pressures. It may also be thought that distance voters are able to shake off

pressures, including for political elections, and that a voting procedure such as this does not
harm the integrity of the poll. And so, audits conducted in the State of Geneva in Switzerland
only reported, for the period 1995-2000 (generalised postal voting was introduced in January

1995), one single case of proven fraud out of 129,580 checks performed on 28 polls

It should also be noted that this risk of pressure is not restricted to electronic voting but
extends to postal voting and voting by proxy. In the case of the latter, the voter entrusts

another with the task of voting on his/her behalf. Likewise, within the scope of postal voting,
pressure exerted at the time that the vote is expressed cannot be excluded; above all, when

the pressure is exerted within a family or professional framework

Postal voting in France now applies to many votes outside of political elections. In addition,

many European states use postal voting for political issues (Switzerland, Germany, Sweden,
Finland, Norway etc.).

•

The difficulty of ensuring the identification and authentication of the voter

Article L. 59 of electoral law:

‘The poll shall be secret’

‘C

ontrols relating to the integrity and probity of the exercising of generalised postal voting rights in the State of

Geneva’

. Patrick Ascheri, Dir. Of the Voting and Elections Service, Department of Justice, Policing, Transport. 1st

November 2000.

The ‘European Commission for democracy through law’ made public a ‘Code of good practice in electoral matters’

(Opinion no. 190/2002 of 19 October 2002). It is specified therein that postal voting, involving a certain number of
‘d

ifficulties’

linked, in particular, to the

’increased risk of family voting’

and to

‘fraud’

‘should only be allowed where

the postal service is safe and reliable’

The Internet rights forum

26 September 2003

Voting away from a polling station makes it more difficult to check the voter’s identity. This
function is, in fact, normally performed direct by polling station members when voters are

ticked off the register of voters. Voting away from the polling station means that this physical
check cannot be performed. It may, therefore, appear to the eyes of certain citizens, to be less

secure.

•

Voting rituals damaged

Passing before the urn, a privileged moment in community and social life and in life as a

citizen, represents, both in the political and professional domain, a ritual that is deeply
engrained in the republican tradition. Going to the polling station also marks a voluntary action

on the part of the individual, demonstrating his/her involvement in the life of the society and
the City and a solemn and public affirmation of his/her entitlement as a citizen. The existence

of a polling station is not neutral. It brings together the electoral body at polling time.

Nevertheless, a questioning, in part, of the tradition of the cubicle, cannot be rejected ‘a priori’

in the name of the intangible nature of physical election procedures. For some elections,
passing before the urn does not represent a strong symbolic moment and, in addition, for a

whole section of the population who have deserted the urns, it is precisely this ritual that is
being questioned. Furthermore, the idea cannot be dismissed that some opponents of distance

voting also have it in their minds that voting at a polling station enables a form of collective
pressure to be exerted, for example, by guaranteeing that certain voters are rallied.

•

The risk of inequality between voters

Within the current context of the low take up of information and communication technologies
by voters, electronic distance voting may appear to be the harbinger of inequality. In reality,

not all voters have access to the technologies used and are not sufficiently skilled in the use of
these tools. A large part of the population could, henceforth, be excluded ‘de facto’ from the

poll. And so, distance voting by internet or by SMS may favour younger populations and the
most privileged social classes who are the main users of information technologies.

It should, however, be noted that this fracture is bound to be reduced as information
technology becomes more widespread throughout society and as individuals develop greater

skills in using these tools.

What’s more, this objection is only valid if the vote is performed solely by means of electronic
distance voting. It cannot be applied to situations where electronic voting is only one method

amongst many other more traditional voting methods.

1.2.3.

The cost of electronic voting

Savings linked to the introduction of electronic voting are often presented as being an

argument in favour of electronic voting. Savings in terms of staff and equipment that may be
brought about by the almost instantaneous electronic processing and analysis of a poll or

economies in terms of ballot papers are often promoted. The cost/benefit ratio of the
introduction of electronic voting would, however, appear to be less clear-cut.

With regard to costs, it would appear to be difficult to precisely estimate the exact cost of an

electronic poll. Added to the cost of investing in the hardware and software required for the
introduction of an electronic voting system are the maintenance and depreciation costs of this
equipment. Hidden costs that are difficult to measure quantitatively should also be added.

These are the human costs of training polling station members and any staff taking part in
voting organisation or procedures, as well as systems managers or even network operation

costs.

The Internet rights forum

26 September 2003

Of course, these costs are variable depending on the voting procedure used. If all the votes

are cast by means of distance voting, one part of the cost may be transferred to the user

. For

example, if the vote is cast by internet, the voter has to use his/her own computer and

connection. If the vote is cast using a voting machine, the investment in equipment is higher

Likewise, these costs may be depreciated over several elections.

With regard to potential savings (cost of ballot papers in polling stations, human resource costs
linked to operating polling stations, in particular, for vote counting), it should be realised that

these only affect a small proportion of poll-related expenses, the main expenses being
constituted by costs linked to voter information (putting propaganda into envelopes and

sending it out) and to the very existence of polling stations.

By way of example, for presidential elections, the cost of sending out candidate’s official
propaganda amounts to 35% of total expenditure and operating costs amount to 13%, 8% of

which goes on electoral meeting costs. Savings relating to a reduction in the number of ballot
papers in polling stations and accelerated processing and analysis are, therefore, only a tiny
part of these electoral meeting costs.

Two factors may, nevertheless, increase savings relating to the introduction of electronic

voting.

Firstly, it is possible to imagine that electronic distance voting may entirely replace traditional
urn voting which would drastically reduce costs relating to traditional polling stations.

But, above all, it is possible to envisage official propaganda being sent electronically to the
various voters. In this event, the cost of the election could be dramatically reduced.

For all that, it would not appear that these two developments can be envisaged in the near

future for public polls (political or ‘prud’homale’ elections). Replacement of the traditional
voting system appears to be difficult to envisage due to limitations in terms of equipping and

training voters.

In addition, sending propaganda by electronic means runs into difficulties in terms of
equipment and frequent changes of e-mail address.

In short, it would appear that the introduction of electronic voting does not allow substantial
savings to be made with regard to the operation of the poll for most elections. It will, on the

other hand, represent an additional initial cost.

1.3.

Initial assessments of electronic voting experiments

The Internet rights forum’s working party held a certain number of hearings. In particular,
these hearings enabled the advantages and the limitations of the different electronic voting
experiments conducted in France over the last two years and more, to be assessed.

These experiments varied in size i.e. they related to political and professional polls and even

local consultations. In the case of political polls, these were conducted alongside the real polls
and without prejudice to traditional voting operations which are the only ones recognised by

law.

According to the election service provider, the cost of electronic voting for French nationals abroad was EUR 61,000

i.e. one Euro per registered voter.

The basic cost of a voting machine, without connection, is approximately EUR 2,000.

The Internet rights forum

26 September 2003

1.3.1.

Experiments with electronic voting for political polls

1.3.1.1. Experiments conducted in Vandoeuvre-lès-Nancy (Meurthe-et-Moselle)

- Type of electronic voting used: both experiments were based on the principle of the voting
kiosk inside the voter’s polling station. Two types of techniques were, however, used:

1. Network voting within the polling station (this took place during the presidential election
(21 April and 5 May 2002).
2. Voting using a smart card bearing voters’ fingerprints (legislative elections in June

2002).

It should be remembered that the town of Vandoeuvre-lès-Nancy had, initially, expressed a
desire to experiment with distance voting without the voter having to go to the polls (internet

voting). The CNIL [French national commission for information technology and civil liberties]

was not in favour of distance voting, for four main reasons:

Sending an access code and password by ordinary mail to a dwelling where several
voters may reside does not guarantee that one voter is not voting several times by
using access codes and passwords belonging to other people in the house;

The opportunity of voting from home is likely to adversely affect voting secrecy and
sincerity since the vote is not invested with the personalisation which it is due and since

it does not guarantee that the vote is free of all influence and pressure.

Servers handling personal data (electoral roll, register of voters etc.) were in New York

and so were beyond any effective control from the national authorities.

The technical mechanism was unable to guarantee the anonymity of the vote

throughout the operation.

And so, the town of Vandoeuvre-lès-Nancy set up electronic voting experiments where voters
were obliged to go to the polls (voting kiosks).

- Gains and advantages recorded with the introduction of electronic voting.

•

Participation was quite sizeable for both voting techniques used

•

Subsequent to the experiment conducted during the presidential poll, a satisfaction
survey was carried out by the ‘mairie’ [local council] on 80% of voters who had voted
electronically. The findings showed that 66% of this sample was in favour of electronic

voting but also that 50% feared that the computer system could be hacked into and
that this type of vote would exclude certain categories of people.

•

The town of Vandoeuvre-lès-Nancy subsequently used the internet to propose that the
town’s primary and secondary school children should take part, on-line (by means of

voting) in a consultation regarding the slogan for the 2003 anti-smoking campaign.
Under these circumstances, the internet enables new forms of public expression and a

new way of consulting the town’s inhabitants to emerge.

- Lessons learnt from the experiment, and limitations.

•

With regard to voting by smart card: difficulties linked to identification by means of
fingerprint (difficulties in appropriate positioning of the index finger, any cuts or wounds

preventing absolute recognition etc.) and too much time taken up in preparing the card

Decision no. 02-222 of 2 April 2002.

With regard to the experiment conducted during the presidential election: the device involved one polling station in

the first round (with three terminals) and three in the second round (six terminals). In the first round: out of 1,280
voters registered at that station, 820 turned out to vote and 468 of these experimented with internet voting. In the
second round: out of 2,181 voters registered at the three stations, 1,720 voted traditionally and 917 of these also
voted by internet.
With regard to the experiment conducted during legislative elections: the device involved one polling station (871
registered voters). Out of 597 who voted, 244 people experimented in the first round and out of 563 who voted, 225
experimented in the second round.

The Internet rights forum

26 September 2003

(fingerprints etc.), since the advantage of electronic voting fundamentally lies in the

speed of the procedure.

•

With regard to network voting: fears that the computer system could be hacked into

and that this type of vote would exclude certain categories of people (cf.
aforementioned satisfaction survey).

1.3.1.2. The experiment conducted in Voisins-le-Bretonneux (Yvelines)

- Type of electronic voting used: voting at a voting kiosk inside the voter’s polling station by

means of the internet during municipal and cantonal elections in March 2001

- Gains and advantages recorded with the implementation of electronic voting.

•

Participation was sizeable

and voting did not lead to any breakdown of equality in

terms of access to the internet tool. On the contrary, all age groups voted in an almost
uniform manner.

- Lessons learnt from the experiment, and limitations.

•

Voting operations advanced too slowly and were quickly saturated (too few voting

points being available and a problem with bandwidth sharing on the ‘mairie’ cable
network was noted).

1.3.1.3. Electronic voting experiments subsequent to the law authorising voting by
e-mail for French nationals abroad for ‘Conseil Supérieur des Français de l’Etranger’

(CSFE) elections.

- Type of electronic voting used: distance voting without the voter having to go to the polls
made possible by a law aiming to authorise e-mail voting for French nationals abroad for CSFE
elections

(28 March 2003). The poll took place from the 19 to the 31 May 2003.

It should be noted that voting for the CSFE is the only election by means of universal suffrage
where the law authorises voting by e-mail.

Experiments have been carried out in the United States with electronic voting because:

The internet network is highly developed there,

French nationals who live there have a strong internet culture,

The participation rate is particularly low there and is dropping steadily.

- Gains and advantages noted with the introduction of electronic voting.

•

Although electoral participation only increased by 2.5 points compared with 1997, this
result was considered to be a relative success in terms of participation

. This rate was

also explained by a massive influx of new registrations in consulates following the
events of September 2001, the electoral roll rising from 50,000 to 61,000 people in just

a few months. It should, however, be noted, by way of comparison, that in Canada, a
country where people traditionally vote more and where ‘paper’ elections for CSFE

representatives were also conducted at the same time in neighbouring wards, the
participation rate dropped (down from 21.1% in 1997 to 14.7% in 2002).

•

Polling station personnel were able to manage the opening of electronic urns and

decode the votes, without any special training.

For the municipal elections, out of the 1,511 voters registered, 946 voted traditionally (i.e. 62%) 276 of whom

voted via the internet (i.e. 18%). For the cantonal elections: 914 voters voted traditionally (61%) 236 of whom voted
via the internet (16%).

Law no. 2003-277 of 28 March 2003

to authorise voting by e-mail for French nationals abroad for ‘ Conseil Supérieur

des Français de l’Etranger’ elections

(appearing in

JO n° 75 du 29 Mars 2003

Out of the 61,000 voters registered in the two American wards, 8,800 voted (i.e. a participation rate of 14.47%).

60.6% of voters voted by internet (5,354 voters, i.e. 8.77% of those registered), 33.84% of voters voted by post
(2,989 voters, i.e. 4.90% of those registered) and 5.6% turned up to vote at the 11 polling stations (491 voters, i.e.
0.8% of those registered).

The Internet rights forum

26 September 2003

- The limitations of electronic voting.

•

The question of the role that the service provider has to play in storing voting data has
been raised. In fact, the contents of the voting database, which has to be stored for the

duration of the appeal time, was archived by a private service provider whilst for
traditional polls, documents are stored by the relevant administrative department.

1.3.1.4. Some experiments with electronic voting abroad

Brazil, Belgium and even the United Kingdom have implemented various electronic voting

procedures for elections of a political nature.

For the time being, it is not possible, in the light of electronic voting experiments, to confirm
that electronic voting increases participation or, conversely, that it has no effect on

participation.

Brazil

is a country that is highly advanced in its use of electronic voting. In the elections held

in October 2000, 109 million voters voted using this system. The introduction of electronic
voting aimed to eliminate electoral fraud, to reduce counting times and simplify voting

procedures for the illiterate (nearly 20% of the population). The system used was that of the
electronic urn with a digital keypad.

The Brazil example has shown that the introduction of voting machines drastically reduces the

number of invalid votes and that this was much greater than the effect on participation. This
seems to be due to the fact that the machines made the multiple votes that each voter has to

cast during elections (as in the United States, Brazilian voters vote on the same day for
different polls i.e. local, federal state and federal elections) much easier to understand and
warned voters of the logical errors that they were likely to make.

Belgium

is a pioneering European country in terms of the use of electronic voting systems.

Electronic voting experiments were conducted as early as 1985. Electronic voting in Belgium is
governed by the law of 11 April 1994, amended by the law of 12 August 2000. The relatively

high cost of this mechanism has prevented the system from being introduced in a generalised
fashion throughout Belgium (50% of wards are involved, i.e. nearly four million voters).

The method adopted was that of voting at a voting machine. The voter identifies himself by
means of a magnetic card on which data are recorded using a screen on which the options that

can be selected with an optical pencil are displayed. In the last municipal elections, the system
was used by 44% of the voters involved. Despite a bill being filed

, in April 2000, for the

authorisation of internet voting, this voting method still does not seem to be on the agenda. In
fact, in May 2001, the Senate Internal Committee adopted a recommendation freezing the

development of electronic voting.

Because of this, only

the United Kingdom

offers any real field of study for electronic distance

voting. In fact, since 2002, and for a three year period, widescale electronic voting
experiments have been introduced.

Experiments have been conducted using all methods of electronic voting. This has included

voting kiosks in the voter’s polling station as well as those located away from polling stations
(such as, for example, in shopping centres or stations), or even distance voting (i.e. by SMS,

or by internet from personal computers, or by interactive television)

Bill proposed by senators Destexhe and Van Quickenborne on 20 April 2000

‘supplementing the law of 11 April 1994

organising automated voting with a view to allowing automated distance voting’

In particular, in Liverpool, Sheffield, Saint Albans, Somerset, Ipswich, Norwich etc.

The Internet rights forum

26 September 2003

Although the results of the pilot elections in 2003 were technically satisfactory, it is difficult to

draw clear and direct information from them regarding the relationship between electronic
voting and electoral participation.

In some cities, a slight increase in participation was clearly observed, but it is difficult to

attribute this just to electronic voting. Lots of other factors could have played a part i.e.
simplified registration procedures, extension of polling time, media promotion (lots of
advertisements and promotions were used for these voting systems), local factors that may

have affected individual polls, novelty effect for places experimenting with e-voting for the first
time (South Somerset and Shrewsbury & Atcham witnessed their participation rates rise

dramatically i.e. +9.3% and +11.8% respectively).

With regard to this last point, it is necessary to make a comparison with places that had
already experimented with electronic voting in 2002. For example, South Tyneside and Chorley

witnessed their participation rates drop (– 8.7% and – 12.2% respectively).

Generally speaking, it should be noted that in places where distance voting alone was offered

(internet, telephone, SMS or even interactive television), no increased in participation was
recorded. Out of the six locations experimenting with these voting methods, only one recorded

a rise in participation (the city of Norwich: + 1.4%).

At the same time, the four locations that only offered voting at a voting kiosk inside the voter’s
polling station also witnessed their participation rate drop (with the exception of Basingstoke &

Deane, with a rise of + 2.6%).

1.3.2.

Experiments with electronic voting for local consultations

1.3.2.1. The experiment conducted in Issy-les-Moulineaux (Hauts-de-Seine)

- Type of electronic voting used: distance voting without the voter having to go to the polls

(internet voting) for the appointment of neighbourhood council members (November 2002).
This experiment was authorised by the CNIL in its decision of 28 November 2002.

- Gains and advantages recorded with the introduction of electronic voting.

•

The experiment was able to show that distance voting without the voter having to go to

the polls is possible in practical terms.

- Lessons learnt from the experiment, and limitations.

•

The participation rate was low

. This was linked both to what was at stake in the poll,

the complication of issuing voting codes, and to the appearance of technical problems:

- The CNIL gave a negative opinion regarding experimentation with an electronic voting

mechanism using the internet during ‘prud’homale’ elections

and so the experiment

witnessed its scope being restricted to an election of little importance where voting
methods were left up to the relevant authority.

Out of the 1,449 people who were registered to take part in the vote, 939 obtained their confidential code and 860

people actually voted.

Decision no. 02-91 of 28 November 2002 relating to the request for an opinion submitted by the Issy-les-

Moulineaux ‘mairie’ regarding experimentation with an electronic mechanism using the internet during ‘prud’homale’
elections stated that ‘t

he guarantee of voting secrecy constitutes a fundamental principle that only the personal and

anonymous nature of the vote, the reliability of electoral operations, effective monitoring of the poll and ‘a posteriori’
checking by the election judge can provide. (…) The Commission considers, in this respect, that this mechanism’s
operating procedures, as described in the request for an opinion, do not provide, in their current state, the assurance
that this procedure effectively guarantees voting secrecy and, in particular, prevents scrutineers or system
administrators from knowing the way in which any given voter has voted, the Issy-les-Moulineaux mairie itself
admitting that the ‘Cybervote project, in its current form, does not guarantee a high level of confidentiality in respect
of the files used’

The Internet rights forum

26 September 2003

- Technical problems appeared (slow downloading of the voting software required and

incompatibility of the voting system with MacIntosh computers). Differences between
the equipment available in different households and risks of a digital divide should be

taken into consideration. Because of this, whether or not voters possessed PCs with
broadband connection affected the success of the vote.

1.3.2.2. The experiment conducted in Orsay (Essonne)

- Type of electronic voting used: voting at a voting kiosk inside the voter’s polling station

(voting using a smart card with a built-in personalised electronic certificate) relating to
questions of local and European interest. Voting took place in two stages and was spread out

between Wednesday and Saturday. The first stage took place between 26 February and 1
March 2003. Voters had to give their opinion on a question of local interest concerning the

enlargement of the metropolitan area. The second stage took place between 19 and 22 March
2003. The question raised involved the oil shortage with which Europe will be faced in several

years time and the energy solutions to be implemented.

- Gains and advantages recorded with the introduction of electronic voting.

•

The experiment encouraged some modernisation of public life since community agents
responsible for the elections, being discharged of their physical tasks, demonstrated

their satisfaction and desire to develop these practices.

•

The voting system proposed functioned in satisfactory manner

- Lessons learnt from the experiment, and limitations.

•

Participation was low

•

Voting using a smart card, chosen, in particular, for reasons of voter authentication,
costs more than other types of electronic voting. For financial reasons and despite a

great influx volunteers, the number of electronic certificates and smart cards issued had
to be limited to 9.4% of the population registered on the electoral roll.

•

The frequency of the polls (two votes in less than a month) resulted in much higher
abstention levels for the second poll.

1.3.3.

Experiments with electronic voting within professional orders and

associations.

1.3.3.1. Electronic voting used by the French national bar council

- Types of electronic voting used: voting at a voting kiosk inside the voter’s polling station and

distance voting without the voter having to go to the polls (internet voting) for the National bar
council (25 and 26 November 2002) made possible by a decree instituting distance voting by

electronic means for the election of members of the National bar council.

- Gains and advantages recorded with the introduction of electronic voting.

•

High participation levels

reinforcing the legitimacy of the Order,

•

Simplicity and smooth operation of the system. There were very few technical problems

during voting; the assistance standard set up only received 150 calls. These related to
difficulties due to lack of knowledge of the system or the fact that access providers

were blocking secure access to the voting site

•

Immediate results.

The experiment involved 925 voters, i.e. 9.4% of the population registered on the electoral roll. The first vote

brought together 682 voters. The second vote brought together 454.

Decree no. 2002-1306 of 28 October 2002 amending decree no. 91-1197 of 27 November 1991 organising the

profession of Legal Counsel.

The usual participation rate was doubled i.e. out of the 16,000 barristers registered to vote on the Paris Law

Society’s electoral rolls, 9,400 took part in this poll. 70% of voters voted by internet.

The Internet rights forum

26 September 2003

- Lessons learnt with regard to the use of electronic voting by a professional order.

•

Introduction of electronic voting gave rise to two appeals that were thrown out by the

Paris ‘Cour d’appel’ [appeal court] (orders dated 19 December 2002).

1) The first maintained that the election of the Order’s council members could only take

place within the scope of a general meeting involving the physical presence of members all in
the same place. The ‘Cour d’appel’ thought that a general meeting could be held electronically
if the amended by-laws permitted this type of dematerialised voting and that this election did

not require the physical presence of each voter in the same place.

2) The second maintained that there was a risk of double votes appearing or of voting

by persons not authorised to vote. The ‘Cour d’appel’ judged that a risk such as this, in this
election, would be prevented by technical monitoring procedures used by service providers.

•

Internet voting was of more interest to young barristers (voting rate of around 80%)
than to older ones (voting rate of approximately 50%).

•

Although voting solely by means of the internet is technically possible, the National bar
council does not envisage complete substitution, in the immediate future, due to the
symbolic value linked to the paper vote.

1.3.3.2. Electronic voting during the Founding congress for the ‘Union pour un
Mouvement Populaire’ [Union for a Popular Movement] (UMP).

- Types of electronic voting used: voting at a voting kiosk inside polling stations, away from
polling stations and distance voting without the voter having to go to the polls (internet voting)

to appoint a management team and ratify the articles of association of the ‘Union pour un
Mouvement Populaire’ (11 to 17 November 2002).

It should be noted that electronic voting alone was open to 164,000 members, traditional
voting not being authorised.

- Gains and advantages recorded with the introduction of electronic voting.

•

High level of participation

•

Modernisation of public life and of a political party (the UMP has now built a voting

identifier code into each membership card).

•

The home voting system has proved to be user-friendly, enabling groups of ‘specialist’
friends to get together and other groups to be started.

- Lessons learnt from electronic voting, and limitations.

•

A technical problem arose i.e. temporary crashing of the intranet resulted in a ten
minute delay in the processing and analysis of results.

•

Voting from home resulted in voting by ‘communities of kindred spirits’ without any real
voting secrecy.

1.3.4.

Experiments with electronic voting for professional polls

1.3.4.1. Electronic voting for elections for the works committee and for trades union
representatives within the e-Laser company

- Type of electronic voting used: distance voting without the voter going to the polls for

election to the works committee and for employee representatives within the e-Laser company
(July 2001).

Out of 164,000 members, 48,000 voted according to the following breakdown:

1) 23,000 voted from their home or workplace.
2) 18,000 voted from a departmental internet polling station.
3) 7,000 voted on the day of the Congress in Bourget.

The Internet rights forum

26 September 2003

- Gains and advantages noted with the introduction of electronic voting.

•

Immediate processing and analysis

•

Positive image of a company equipped with modern communication tools.

- Lessons learnt from the experiment, and limitations.

•

No rise in participation rates

•

The end of the electoral ambience that can only be achieved with a traditional paper

vote.

•

Given these lessons, it was thought preferable to reinstate a polling station for the next

polls conducted via the internet during professional elections.

1.3.4.2. Electronic voting organised within Foreign affairs department information

and communication systems attaché corps

- Type of electronic voting used: distance voting without the voter having to go to the polls
and voting at a kiosk inside polling stations for the election of Foreign affairs department
information and communication systems attaché corps (ASIC) employee representatives, made

possible by a ministerial order issued on 11 February 2003 permitting the use of electronic
voting.

Distance voting was spread out over a week (17 to 24 March 2003). An electronic terminal was
also installed inside the paper vote polling station where the vote took place on 24 March

2003.
Prior existence of postal voting for this type of election should be noted.

- Gains and advantages recorded with introduction of electronic voting.

•

High level of participation

•

No technical hitches on the on-line voting side, immediate processing and analysis.

•

Voters who voted by internet all demonstrated their satisfaction in respect of use of this

voting system.

- Lessons learnt from electronic voting, and limitations.

•

Paradoxically, the majority of voters based abroad voted by paper postal vote. In fact,

some attachés seem to have been worried about the reliability of the system and
preferred to cast a postal vote for fear of not being able to vote.

•

The location of the server was discussed. The service provider positioned the server in

the United States. Some voters thought that the server should have been in France and
wanted the server’s location to be clearly specified prior to the introduction of electronic

voting.

•

Electronic checking of the register of voters was not possible due to uncertainty as to

polling station opening and closing hours. Checking had to be done over the phone to
prevent any double voting.

•

Some voters said that they had reservations about the fact that it was the service
provider direct who printed and sent out the codes and passwords. The service provider
did, however, assert that more secure procedures would have had an impact on

election costs.

•

It was not possible for some voters to gain access to the vote due to the fact that their

navigator was too old and did not support the voting system’s security levels.

Participation rose by 20% in comparison with the previous poll i.e. 67 attachés were entitled to vote, 50 cast a vote.

The total number of paper voters was 29 (23 postal votes and 6 votes at the urn). 21 voters voted electronically.

The Internet rights forum

26 September 2003

PRINCIPLES AND PLAN OF ACTION FOR THE ROLLOUT OF ELECTRONIC VOTING

2.1.

Electronic voting rollout principles

2.1.1.

Plan for gradual electronic voting rollout

The Internet rights forum believes that electronic voting rollout must be encouraged

so as to take into consideration the growing presence of information and communication

technologies in most citizens’ activities as well as the undeniable contribution made by
electronic vote counting and management.

This rollout must, however, take the cultural, social or even geographical specificities of a

country like France into account.

The Forum believes, therefore, that it would be

illusory, given the current state of techniques and the perceptions of the electoral
body, to recommend the rollout of electronic distance voting for all polls, in

particular, for elections of a political nature.

Electronic voting must not, therefore, be implemented in a uniform manner but
introduced gradually, with decisions being taken on a poll by poll basis

All votes are not, in fact, the same in terms of what is at stake, the sensitive nature of the

issues being voted on, their symbolic weight or the abstention rate. A poll taken inside an
association is not comparable to a presidential election. The practical procedures and security
levels involved will have to be very different.

We must, therefore, be careful not to impose identical requirements for all polls. Each type of

vote requires a particular approach so as to determine whether or not it is possible to use
some form of electronic voting and so as to determine the specifications that are desirable in

terms of organisation and voting security.

For public polls, it is up to public authorities to define these rules. In other situations, these
rules have to be defined by the private players directly involved in the election, since they may
have different understandings of the risks.

The Forum recommends that this

rollout should be conducted gradually on the basis of

lessons learnt from different experiments.

The use of electronic voting in some polls must, therefore, be evaluated so as to determine the
lessons that can be learnt for other types of polls.

2.1.2.

Public authorities to retain their role for public polls

The Internet rights forums wishes public authorities to continue to be in charge of
the design and operation of the polls that it is responsible for organising.

The unavoidable changes in concrete means of expressing votes that have accompanied

changes in French society, must not lead us to forget that the organisation and management
of public polls (political, ‘prud’homale’ and consular elections) expressly relate to the

challenges of public power i.e. an expression of national sovereignty and how justice and the
economy are organised.

Consequently, a public service relating to the organisation and guiding principles for the
operation of public polls, is a public service that appertains to the royal prerogative and is just

as fundamental as law and order or justice and cannot, on principle, be the subject of
withdrawal, nor of delegation to private players.

The Internet rights forum

26 September 2003

Relations between public authorities and private service providers must, therefore, under all
circumstances, ensure that strategic choices, including those with a major technical impact,

are a matter either for unilateral acts of public power, or for the distribution of basic service
provisions by means of public tenders in accordance with competition regulations. The State

must also check that the technical solutions proposed do not have the effect of disregarding
the electoral rules and practices laid down by the legislator and by Republican tradition.

As reiterated by the French Council of State in a public opinion issued on 7 February 1995

an electronic voting system used for a public vote must subject to technical approval

on the part of the relevant ministry, issued on the basis of specifications

The principle of the technical approval is of primary importance, since it guarantees that no
provider of computer services can be accepted to manage the electoral roll and voting

operations unless its voting system adheres, at each stage, to the principles considered to be
fundamental by the State in terms of guaranteeing the sincerity of the vote. The declaration to
the CNIL (cf. 3.1.1.) is in keeping with this objective by enabling it to check the conformity of

the voting system in relation to personal data protection principles.

The Forum believes that it is vital that the specifications should contain clauses
intended to ensure the effective guarantee of adherence to the poll’s fundamental

principles and rules

. The Forum, in particular, believes that the specifications should contain

a certain number of requirements, details of which are given in part 3.1.3.

2.1.3.

Allowing electronic distance voting when postal voting is already in

existence

There is no reason why provision should not be made for the possibility of electronic distance

voting from home or from the workplace where provision has been made for the routine
alternative of postal voting. In fact, electronic distance voting, in principle, does not appear to

be any less secure than postal voting. Postal voting is liable to many of the criticisms made by
opponents of electronic distance voting,

Postal voting also relies on sending the voter material that enables him/her to vote by post.
Since the voter is not at a dedicated voting site and is not subject to any particular

supervision, there is nothing to stop pressures from being placed upon him/her.

In the same way, voter authentication does not appear to be any more guaranteed by postal
voting.

Of course, some postal elections provide for a form of monitoring by requiring the voter’s

signature to appear on the envelope. In addition, however, to the fact that this is not a general
requirement, it is often no more than a formality since the signature cannot be compared to
the voter’s actual signature by the polling station.

In short, where postal voting is already in existence, objections that electronic voting would

constitute symbolic damage in respect of the voting process, could not be made.

Electronic distance voting would appear to be a new means of postal voting with added
advantages in terms of processing and analysis.

Of course, electronic voting involves specific risks, as we have mentioned above. These risks
do, however, appear to be technically controllable provided that system security is adequate

Postal voting also involves its own set of risks, in particular, with regard to fraud.

Opinion no. 357 182. ‘Section de l’Intérieur’ [department of the interior] 7 February 1995,

EDCE

Public report 1995.

no.47. p. 112

The Internet rights forum

26 September 2003

The Internet rights forum believes, therefore, that it should be possible to vote by
means of electronic distance voting where provision has been made for postal

voting,

should the main players involved in the election so wish.

2.1.4.

Envisaging electronic distance voting as an additional method of voting

Electronic voting inside a polling station does not raise problems with regard to the principle of

voting equality. In fact, all voters can access the voting kiosk.

The introduction of electronic distance voting raises more problems due to disparities in terms
of voters’ equipment and the degree to which they have taken new technologies on board.

Electronic distance voting cannot replace traditional voting at the urn unless all voters possess

the equipment required in order to take part in the vote.

In addition to these equipment-related problems, it is also necessary for voters to be fully

competent in the operation of these tools in order to take part in the poll.

For the large majority of polls, these two restrictions prevent us from envisaging
straightforward replacement of physical voting methods, either by means of votes cast inside a

polling station, or by postal voting, with electronic voting. As things stand, such a replacement
can only be envisaged for restricted polls where all voters possess the equipment and sufficient

technological know-how to vote by means of electronic distance voting (net surfer
associations, companies where all employees are connected to a network etc.).

The Internet rights forum believes, therefore, that the principle of voting equality
means that electronic distance voting should only be thought of as one means of

voting, as an additional method that does not exclude more traditional methods.

2.1.5.

Organising electronic voting around the main players in the election

Since the rollout of electronic voting involves all voters, it is up to them to fix the objectives
relating to its development and to equip themselves with the means of guaranteeing reliable
conditions.

It is, therefore, necessary to leave the choice of voting procedure, depending on the type of

vote, up to the players involved, by bringing them together upstream of the decision-making
process. Some polls of a non-sensitive nature may, therefore, by the subject of distance voting

provided that this is the wish of the players involved.

For elections of a political nature

, in so far as there is an impact on the democratic

process,

the Forum believes that the main phases of the development of electronic

voting must be subject to previous widespread public debate.

2.2.

The action plan for the rollout of electronic voting

The Internets rights forum believes that electronic voting must be introduced in a gradual and
reasoned manner, on a poll by poll basis.

From this perspective, the Internet rights forum recommends the following action plan:

In this respect, the European Commission for democracy through law (cf. aforementioned) believes that electronic

voting may be used if the system is

‘secure – it can withstand deliberate attacks – and reliable – it works whatever the

shortcomings in terms of software or hardware.

(…)

In addition, the voter must be able to obtain confirmation of

his/her vote

(…)

and the transparency of the system must be guaranteed, in the sense that correct operation can be

verified’

The Internet rights forum

26 September 2003

2.2.1.

For political elections

2.2.1.1. Electronic distance voting should not be introduced but electronic voting at

a voting kiosk in any polling station should be authorised

From lots of different perspectives, political elections would appear to be a specific case.

Unlike other States (Germany, United Kingdom, Switzerland), postal voting for political

elections has not been authorised since the law of 31 December 1975. The ritual of voting at
the urn appears to be very firmly fixed in citizens’ minds, voting secrecy being a basic principle

of this ritual. Because of this, it does not seem that not going to the polls is likely to be easily
accepted whilst this option is still a possibility.

For all that, the existence and development of postal voting abroad my justify a debate on our

voting traditions.

The Forum believes, in fact, that in-depth consideration of a paper

postal vote in political elections cannot be excluded and that it may be necessary to
conduct a widespead debate on this topic

For all that, at this stage,

the Internet rights forum does not recommend electronic

distance voting for political elections.

On the other hand, the Forum recommends the introduction of electronic voting at a
voting kiosk in any polling station.

This solution would appear to be more easily controllable in terms of system security, provided
that the vote is cast on a private network. This would meet the expectations of more mobile

voters who may be away from home on the day of the poll but may still be able to access a
polling station.

The French ministry for the interior recently launched a debate on the use of electronic urns.

Electoral law does, in effect, provide for the possibility of using voting machines inside polling
stations

. In the past, experiments with voting machines have not met with a great deal of

success

The emergence of electronic voting requires investment in a new generation of computers to

enable voting from any polling station.

This change may require electoral law to specify that the voter may vote in a polling station
other than his/her usual polling station. This would also require electronic management of the

electoral roll in the form of a national voter file (see 2.3.2.).

It will require investment on the part of the State to contribute towards equipping the ‘mairies’
and towards the cost of the means of transferring date from polling stations to central servers.

Subsidies for electoral equipment (urns) are currently paid to ‘communes’ on a fixed rate
basis.

The Internet rights forum recommends that the State should undertake to bear

the specific cost of electronic voting system equipment

either direct, or by means of

reimbursements or additional subsidies given to those communes wishing to acquire the

equipment.

Article L.57-1 of the electoral regulations issuing from the law of 10 May 1969.

In the Seventies, voting machines approved by the Ministry for the interior were used. Due to the fact that

malfunctions occurred (repeated breakdowns, very high maintenance costs), they were gradually abandoned until they
finally disappeared completely in 1986. This type of voting was only used in the Ile-de-France region and in Corsica.

The Internet rights forum

26 September 2003

2.2.1.2. Authorising electronic distance voting for local referendums

The constitutional amendment of 28 March 2003 expanded the role of local referendums.

Although local referendums used to be simply consultative, article 72-1 of the Constitution
henceforth laid down that all local governments may organise referendums of a decision-

making nature. Organic law defines local referendum principles whilst polling procedures are
referred for decree by the ‘Conseil d'Etat’ [Council of state].

The Internet rights forum wishes experiments with distance voting to be applied to
local referendums.

2.2.1.3. Extending the possibility of electronic distance voting for the appointment

of French nationals abroad sitting on the ‘Conseil Supérieur des Français de
l’Etranger’

The experiment conducted in the United States for the ‘Conseil Supérieur des Français de
l’Etranger’, made possible by a law of March 2003 (cf. 1.3.9.), must, therefore, be generalised

so as to facilitate voting for all French nationals living abroad.

The Forum recommends that electronic distance voting should be used by all French
nationals abroad.

2.2.2.

For ‘prud’homale’ elections

Although ruling relating to the simplification of the law adopted in July 2003

provides for

electronic voting to be introduced for ‘prud'homale’ elections, the procedures specified by the

latter are still to be determined.

‘Prud'homale’ elections do, however, appear to be polls of a sensitive nature in the eyes of the
two sides of industry, since they enable the representative nature of the various trades union

federations to be measured. Some sectors of management and labour have, therefore, clearly
marked their opposition to any kind of electronic distance voting. The idea of electronic voting

by means of voting kiosks seems, on the other hand, more easily acceptable.

Consequently,

the Forum believes that ‘a minima’ provision for voting at a voting kiosk

in any polling station for ‘prud'homale’ elections may be envisaged

A change like this will be even more likely if elections take place inside ‘mairies’ and are able
to use political election voting kiosks. In addition to this mutualisation of infrastructures there

must be a debate on the electronic management of the electoral roll so that voting from any
polling station can be offered.

It is undoubtedly possible to go further than this initial voting method and to provide
for distance voting experiments for certain categories of voters.

There are two main reasons that support this change:

- the rate of participation in ‘prud'homale’ elections is low

;

Article 19 of law no. 2003-591 of 2 July 2003 authorising the Government to simplify the law provides for

‘the

introduction of electronic voting for elections to chambers of commerce, industry, trade and agriculture, to agricultural
rent tribunals and for ‘prud'homale’ elections’

Out of the 17.5 million voters registered in 2002, only 5.6 million people voted, i.e. a participation rate of 32.6%.

The Internet rights forum

26 September 2003

- postal voting procedures have already been greatly relaxed and during the last elections all

requirements for prior authorisation by the ‘maire’ of voters whose business prevented them
from going to the polling station was removed.

The Forum recommends that electronic distance voting experiments be conducted

during the next ‘prud'homale’ elections for the employers’ board

since the

representative organisations are, on the whole, in favour of this change and the volume of the
electoral body is relatively limited, and even

for the managerial section of the employees’

board

for which the rate of computer access and computer literacy is, overall, high.

2.2.3.

For ordinal and consular elections

Provision has been made for postal voting for most elections to professional orders, chambers
of commerce, industry, trade and agriculture.

In addition, the aforementioned law of July 2003 provides for the introduction of electronic
voting for chambers of commerce, industry, trade and agriculture.

Consequently,

the Forum believes that electronic distance voting should be the

authorised voting method for these elections.

With regard to elections to professional orders or to regulated professions, distance
voting must be introduced if the organisations in question are in favour.

As has been said earlier, a distance election has already been conducted for the national bar
council. One is also planned for the next consular elections and this type of voting is envisaged

for elections to agricultural rent tribunals and for ‘prud'homale’ elections

The introduction of electronic distance voting requires amendments to texts applicable to these
bodies so as to enable electronic distance voting in addition to postal voting. These texts are

listed in the appendix.

2.2.4.

For professional elections

The choice of electronic voting procedures should be left to dialogue between management and

labour.

Professional elections have a particular symbolism for trades union organisations. They do, in
fact, appear to be a special moment in corporate and governmental life, ensuring that the

community gathers together and this is recognised by time being given off work.

What’s more, workplace elections take place within a particular context since the employer,
private or public, is the stakeholder and may be more easily suspected of seeking to falsify the
poll or to find out how people are voting.

This is why many union contacts do not envisage the possibility of distance voting for

employees’ representative elections.

For all that, it would appear to be necessary, within this framework, to allow there to be
dialogue between management and labour within companies and government offices so as to

permit electronic voting to be introduced, where appropriate, by means of voting kiosks inside
polling stations or by distance voting.

2.2.4.1. Professional elections within the private sector

The Internet rights forum

26 September 2003

Within the private sector,

the Forum recommends that the provisions of the labour law

currently only permitting paper voting should be amended

. Electronic voting should,

therefore, be permitted by making the choice of voting procedures (distance voting, voting at

a voting kiosk) subject to a prior agreement on the part of labour and management.

2.2.4.2. Professional elections within the public sector

In the public sector,

the Forum recommends that there should be consultation between

the two sides so as to permit electronic distance voting for elections within joint

administrative committees and joint technical committees

. The changes will require

amendments to the applicable texts. A certain number of texts providing for postal voting for

professional elections within the public sector appear in the appendix.

2.2.5.

For elections within associations, general shareholders’ meetings and

public service user consultations

2.2.5.1. Learning lessons and encouraging the practice of electronic voting within
associations and general shareholders’ meetings

These elections are legally entitled to use electronic distance voting which often appears to be
the solution most suited to their needs.

Associations’ flexible legislative framework may enable them to operate by making use of

information technologies. Electronic voting only requires amendments to the articles of
association and possibly the rules of procedure. Jurisprudence has, therefore, agreed that an

association may hold a general meeting via the internet

Corporate law has also permitted distance voting via the internet during companies’ general

meetings since the decree of 3 May 2002, issued on the basis of the law of 15 May 2001
relating to new economic regulations.

In all cases,

it would appear to be necessary to permit the main players to exchange

their experiences

. Such experiments would be particularly interesting in major associative

networks.

2.2.5.2. Permitting consultation and electronic distance voting for public service
users

Some public service user elections made provision for postal voting (see in appendix).

The Internet rights forum recommends that consultation and electronic distance

voting procedures be introduced for public service users provided that the main
players involved are in favour.

This proposal could, for example, concern two sectors:
- elections of school parent representatives to school councils;

- elections of student representatives within universities.

Articles L. 423-13 and L. 433-9 of the Labour law lays down that ‘

The election shall be conducted by means of a

secret ballot by envelope”

Paris ‘Tribunal de commerce’ [Commercial court], 10 October 2001.

The Internet rights forum

26 September 2003

PRACTICAL, TECHNICAL AND LEGAL PROCEDURES FOR THE ROLLOUT OF

ELECTRONIC VOTING

The introduction of electronic voting for public polls means reviewing the organisation of the

electoral process and, if necessary, adapting electoral laws.
Provision will be made for practical voting procedures within the scope of the specifications
mentioned in 2.1.2.

3.1.

The declaration to the ‘Commission nationale de l'informatique et des libertés’

An electronic voting system that involves the use of automated processing of personal data,

(in the sense of article 5 of the law of 6 January 1978

). Henceforth, this must be the subject

of a declaration to the ‘Commission Nationale de l'Informatique et des Libertés’ by the entity

responsible for data processing, prior to the system being introduced.

3.2.

Electronic management of the electoral roll

Electronic voting requires unequivocal authentication of the electoral capacity of persons taking

part in the poll. Although they appear to be separate issues, debate on electronic voting also
involves debate on electronic management of the electoral roll. This roll ensures that a

person’s electoral capacity cannot be expressed more than once during voting operations.

The electoral roll fulfils several roles:

It lists all persons with the right to vote. This is the figure that may determine,
if necessary, a legally defined quorum.

It distributes these people according to a geographically determined territory,
which is the polling station. Grouped into these communes, then into various

electoral wards, it determines the right to choose between representatives
within a defined territorial boundary.

It constitutes the medium for the register of voters during voting operations.
To this end, the electoral roll, approved on a certain date, is final. Any

amendment supposes a legal decision taken in accordance with procedures
defined restrictively by electoral law (Cf. art. L. 30 and subsequent articles)

The second point poses a problem when voting at a voting kiosk from any polling station is
envisaged, such as for traditional political elections and ‘prud'homale’ elections. In fact, the

polling station must be able to check that the voter has not already exercised his/her right to
vote.

The Forum recommends, therefore, that electoral roll management be modernised.

Centralised electoral roll management already exists for ‘prud'homale’ elections. For political
elections, INSEE [French national institute of statistics and economic surveys] is already

responsible (art. L. 37 of electoral law

) for managing a national voter file in order to prevent

double registrations. Links with the communes are, however, entirely by means of traditional

hard copy.

The Forum believes that modernised electoral roll management would involve rolls
being managed electronically in the form of a voter file that would enable a

consolidated register of voters to be produced for each election.

In the sense of this article, for example, all operations performed in order to compile a computer voter file, the

automatic processing of results for personal data relating to candidates or even the constitution of the register of
voters, would be involved.

Article L. 37 of electoral law: ‘

The ’Institut national de la statistique et des études économiques’ is responsible for

keeping a general voter file with a view to monitoring listing on electoral rolls’

The Internet rights forum

26 September 2003

The Forum recommends that procedures for using this national file should be as

follows:

Verification of voting right

It should be possible to access the file from any polling station in the territory so as to check to
see whether the voter has already voted at another polling station. This check may be
performed by members of the polling station, as it is at the current time, or else direct by

means of an authentication solution held by the voter.

The file may enable voters to check, prior to the election, whether they are listed on the
electoral roll. This access must, however, be limited to the voter in question who should only

be able to check his/her listing by means of a dedicated site. Full circulation of the electoral roll
on the internet would, in fact, disregard the principles of personal data protection.

Recording the voter’s vote

The system must enable the voter, once verification has taken place, to make his/her choice
from the ballot papers for his/her polling station’s candidates at the voting kiosk.

This vote must then be transmitted to the electronic urn at his/her polling station.

It should be noted that this stage is technically more complex for elections involving a large

number of candidates (local, regional, cantonal, legislative elections etc.) than for elections
taking place within a single constituency (presidential, referendums).

Updating of the register of voters and the electoral roll

The register of voters must be updated so as to indicate whether or not the voter has already
exercised his/her voting right.

Updating of electoral rolls according to the electoral timetable rather than on a yearly basis,

would prevent voters from being listed in two wards and would enable voters’ increasing
mobility to be taken into consideration.

3.3.

Voting security

The attacks to which an electronic voting system could be subjected have been described in
part 1.2.2.1. Nevertheless, the Forum believes that the security levels of an electronic voting

system used for a major political election should differ from those implemented for an election
within a professional order or an association.

Use of a VPN or Virtual Private Network

is likely to considerably reduce the risks of system

intrusion. It is this type of network that will be used for political elections from voting kiosks.

It does, however, increase voting costs and cannot be used for distance voting with a large

number of registered voters. It would, therefore, be difficult to envisage using this system for
distance voting for major public polls. In this case, experiments will enable the difficulties

relating to distance voting on a grand scale to be tested in a sufficiently clear-cut manner.

Cryptology solutions used by computer applications must be tough enough to prevent any
intrusion that would put the voting process or the integrity of the data at risk.

A VPN or Virtual Private Network consists of setting up a private sub network, within an unprotected infrastructure

such as the internet, by means of secure connections.

The Internet rights forum

26 September 2003

Should the voting system jam, it must be possible to vote electronically at a neighbouring

polling station. During the experimental phase, provision must be made for a paper voting
system at central offices.

3.4.

Voter authentication solutions

Voter authentication is not a problem when the vote is cast inside a polling station. In fact, it is
then up to the members of the polling station to check the identity of the voter and to make

sure that he/she has not already voted by checking the register of voters.

The question is, however, raised for electronic distance voting.

There are different voter authentication solutions on the market:

- identifiers and passwords

- electronic certificates
- smart cards

The authentication solution must be in proportion not only to the size and sensitivity of the
poll, but also to its cost.

For elections where the stakes are limited, the Forum recommends that the voter

should be able to identify him/herself quickly and easily by means of an identifier
and a password

In this case, the voter may be given a unique personal identification number (PIN code) which
must only be valid for one single poll. In fact, so that the voter’s selection is never associated
with his/her ballot paper, the PIN codes must be generated in a random fashion and must have

a life limited to just one ballot. It is possible to imagine an election within an association, or
even a professional order, being operated in this way. Depending on the sensitivity of the poll,

it is possible to envisage that the password could be sent by recorded delivery mail so as to
limit the risk of fraud. This precaution would, however, increase the cost of the election.

For more sensitive and more regular elections, the Forum recommends that

provision be made for a double identifier.

In this case, the voter must first be given a general identifier and then a second identifier will
be sent to him/her at election time.

3) Authentication solutions offering a higher level of security do exist, such as electronic

certificates

or smart cards.

The CNIL has estimated that voter authentication based on an electronic certificate would be
the most satisfactory state-of-the-art solution

. We can also think about authentication by

means of a secure personal card of the ‘smart card’ type. Incidentally, the latter may be
combined with biometric systems (fingerprints, for example, i.e. experiments mentioned in
1.3.1.).

The Internet rights forum recommends that the voter authentication dimension

should be taken into consideration in the ‘daily life card’ and ‘electronic identity card’
projects.

Electronic certificates, which are available with several different security levels, are distributed in the form of a piece

of software that can be installed on a computer hard drive or carried on a smart card. The certificates rely on the
principle of asymmetric cryptography which combines a private key issued to the person in question and remaining
under their control with a public key which enables their identity to be established.

Decision no. 03-036 of 1 July 2003 bringing about the adoption of a recommendation relating to electronic voting

system security.

The Internet rights forum

26 September 2003

For example, with regard to the daily life card, the authentication and access control card

aspect proposed therein may permit voting for local elections

. The public body responsible for

validating the implementation of a system such as this could be the ‘Direction centrale de la

sécurité des systèmes d'information’ [Central information systems security division]

3.5.

Voting confidentiality and sincerity requirements

The system must also be designed so as to prevent the vote cast by the different voters from

being retraced or amended.

The CNIL has, in addition, recently adopted technical recommendations on the subject of
electronic voting system security

where it specifies that ‘

voting secrecy must be guaranteed

by the implementation of procedures that make it impossible to establish a link between the
name of the voter and the expression of his/her vote’

The Forum has established that, with state-of-the-art technologies, the identity of the voter
and his/her choice of vote may appear simultaneously for a very short period of time on the

voting machine. The Forum has also found that, with enough computer power, it is possible to
decode ballot papers that could be damaged in the medium term.

Within the scope of strict adherence to the principles listed in the specifications (cf. 2.1.2.),

this risk can be limited by making provision, in particular, for the roles of the different
technical players providing the electronic voting system to be separated, and by reaffirming

the system administrator’s obligation of confidentiality.

Within the scope of public polls,

the Internet rights forum recommends that voting

operations should be entrusted to two different technical players, properly identified
as such, and whose computer systems are separate, dedicated and isolated

, known

hereinafter as voting system administrators:
- The manager of the electoral roll that gives the authorisation to vote;

- The manager of the electronic urn that collects the votes.

The Forum recommends that the voting system architecture should be secure enough
to prevent voting system administrators from being compromised

(reconstruction of

the voter’s choice of vote, usurpation of identity, urn jamming etc.). Of course, these
administrators must be able, if necessary, to carry out technical maintenance (repairs in the

event of breakdown etc.,

but the

Forum wishes to reiterate the fact that they should

never be able to implement procedures enabling them to modify either the number of
votes in the electronic urn, or their contents.

The Forum also wishes to specify that guaranteeing the integrity of the information

transmitted also supposes that a system or machine breakdown could not result in
votes already cast being erased or amended.

On 9 July 2003, the ministry responsible for State reform, the ‘Caisse des Dépôts’ [public savings office] and a

certain number of local authorities launched pilot ‘Daily Life Card’ applications. This card gives access to the services
supplied by different administrations or public services. Three types de services can be offered i.e. a card intended for
schoolchildren and students enabling them to pay (by virtue of a family account associated with the card) for services
(school dinners, photocopies etc.) and to access facilities (media resource centres, swimming pools etc.), a transport
card (intended for all) and an authentication and access control card, for the entire population, that can be used for
physical services (institutional catering, sporting and cultural facilities) and dematerialised administrative acts (signing
forms on the internet, access to tax accounts, company accounts etc.).

‘La Direction centrale de la sécurité des systèmes d'information’ (DCSSI) [Central information systems security

division] is answerable to the Secretary general for national defence. Its mission is, in particular, to contribute to
defining government policy regarding ‘sécurité des systèmes d'information’ (SSI) [information systems security], to
act as a national SSI regulatory authority (by issuing approvals or certificates for Government information systems
and for cryptology procedures used by the government and public services) and even to develop scientific and
technical expertise within the domain of SSI, to the benefit of the government and the public services.

Aforementioned decisions.

The Internet rights forum

26 September 2003

In order to prevent such risks, an obligation of confidentiality is guaranteed by article L.116 of

the electoral law which provides, in particular with regard to voting machines, for penalties for
individuals interfering with voting secrecy

. Likewise, article 29 of the ‘Loi Informatique et

Libertés’ [data protection law] provides a framework for this by guaranteeing the security of
the information transmitted

Nevertheless,

since the scope of article L. 116 is quite wide, the Forum wishes to

specify that it should be applied not only to those responsible for the poll but also to

engineers in charge of the smooth operation of the technical device.

For all that, and even if the risks of the voting system being compromised are still possible,
such risks must not prevent electronic voting from being developed. It is, in fact, necessary to

find a balance between the cost of the election and the voting security desired. This balance
must be dependent on the poll and must not increase the complexity of the latter nor raise its

costs.

This is why

the Forum believes that the aforementioned voting system

recommendations should apply, as a priority, for the largest polls, i.e. public and

professional polls.

3.6.

Electronic voting rollout

3.6.1.

Electronic voting operations

Diagram of electronic voting sequence

The

communications networks

enable a link to be established between the four ‘players’:

The virtual polling station (voting kiosk, personal computer etc.)

The manager of the electoral roll

The manager of the electronic urn where the votes are stored during the poll

Those responsible for the poll (chairman, assessors) who check to see that it is running

smoothly and monitor its closure and processing and analysis of votes.

‘Those who, by means of any fraudulent representations whatsoever

(…)

, have interfered with, or attempted to

interfere with, the sincerity of the poll, have breached or attempted to breach voting secrecy, prevented or attempted
to prevent polling operations, or who, by the same fraudulent representations, have changed or attempted to change
the results, shall be punished by the penalties contained in said article. The same penalties shall be applied to any
individual who may have damaged or attempted to damage the operation of a voting machine with a view to
preventing polling operations from continuing or falsifying results’.

‘Because of this, any person sorting or processing personal data shall undertake, in respect of the persons in

question, to take all necessary precautions to keep the information safe and, in particular, to prevent the information
from being deformed, damaged or communicated to unauthorised third parties’

The Internet rights forum

26 September 2003

Diagram text:

Phase 1:

Authentication of the registered voter

Phase 2:

Assignment of a token (right to vote)

Phase 3:

Placing of the vote in a virtual urn

Phase 4:

Confirmation of the vote

Phase 5:

Validation of the vote (check to ensure the voter has not already voted)

Phase 6:

Poll audit. Closure and processing and analysis.

NB: All the phases use the communication network to form a link between the players. The
proposed diagram, which applies, above all, to elections of a political nature, can be adapted

for any type of poll or consultation.

Description of phases

Phase 0:

System initialisation. Before the poll opens, those in charge of said poll must be able

to check the integrity of the electoral roll, that the virtual urn is empty and that the vote
counters are set to zero.

Phase 1

The voter must prove his/her identity to the manager of the electoral roll. As seen

above (cf. 2.3.4.), the procedure used may range from the use of an identifier combined with a
PIN code to use of a smart card.

Phase 2:

If the voter is authenticated (entered on electoral roll) and has not yet voted, he is

credited with a token (random number), giving him/her the right to vote. The voter then

The Internet rights forum

26 September 2003

makes, from his/her virtual polling station, the selection, or selections, appertaining to the

poll.

Phase 3:

The virtual ballot paper is encrypted and, accompanied by a token supplied by the

electoral roll manager, is transmitted to the virtual urn. The encrypted ballot paper is retained

in this state, in the virtual urn, until the counting phase.

Phase 4:

Upon receipt of the ballot paper, the electronic urn confirms that the vote has been

received.

Phase 5:

Upon receipt of voting confirmation, the virtual polling station transmits a request to

the manager of the register of voters. This register of voters is associated with the voting

identity and may, possibly, be stored on a smart card. The manager of the register may then
validate the voter’s vote and complete the voting sheet (preventing the voter from voting more

than once). It must be possible to print out the register of voters who have voted electronically
and possibly use it to record the votes of other voters voting by post or at the urn. In addition
the CNIL wants

the record to

‘include a time stamp’

Phase 6:

When the poll closes, the managers open the virtual urn and analyse the votes. The

ballot papers are decoded, so as to extract the content of the vote and are then counted.
The Forum recommends that the activation of the decoding key should be conditioned by the

simultaneous and complementary action of two managers i.e. the chairman of the vote and
one of his assessors.

During the polling process, the polling managers must be able:

to register the number of ballot papers placed in the urn,

to register the number of voters expressing a vote (establishing the participation rate).

3.6.2.

Determining special procedures for electronic distance voting

The Internet rights forum recommends that electronic distance voting should take
place over several days.

The voter may, therefore, benefit from a longer period in which to exercise his/her voting
right. This extension also means less risk of the information systems becoming congested. This

extension can also apply to postal voting. It has been introduced for electronic voting for the
‘Conseil Supérieur des Français de l’Etranger’, in the United States

This voting period must, however, conform to certain constraints:

- The voting deadline must be adapted to the nature of the election and the sociology of the

voters. It must not be so short that there is a risk of depriving some voters of the opportunity
to vote, in particular if the identifier only reaches the voter a few days prior to the vote.

- The date on which the poll is to open must be given to the voter when his/her identifier is
sent out. If the voter attempts to send his/her vote prior to this date, the system must tell

him/her that the poll does not open until a later date.

- The final date after which the vote cannot be recorded must be made clear to the voter when
his/her identifier is sent out.

The Internet rights forum believes that it would be preferable for the electronic
voting deadline to be prior to the deadline for voting at a polling station

. This

precaution will facilitate checking to ensure that voters have not already voted.

Ibid.

Electronic voting for the CSFE was spread out over 12 days.

The Internet rights forum

26 September 2003

The Forum recommends that electronic voting should be final.

Although taking place

over several days, it should not be possible to amend the vote once it has been cast. Voters
will not, therefore, be able to substitute electronic votes with votes cast at the urn on the day

of the election or with postal votes.

Of course, the opportunity to take back one’s vote exists for some postal ballots where the
voter, arriving at the polling station on the day of the poll, can withdraw the ballot paper that
he/she has previously posted. This offers the benefit of ensuring that the voter’s voting right is

not usurped by another person but would make it impossible for the voter’s identity and the
nature of his/her vote to be separated during electronic voting.

This difficulty can be avoided if the system uses an electronic signature operating on the

principle of asymmetric encryption. The electronic signature placed on the electoral register
would mean that the act of voting could not be repudiated and so would be a form of proof of

voting. This solution does, however, involve higher costs.

3.7.

Encouraging voters to take the electronic voting system on board and have

confidence in its operation.

3.7.1.

The ergonomics of the electronic voting system must be studied so as to

make voting as simple as possible for users

The candidacies must be as legible as possible for the voter. Furthermore, in the event

of electronic distance voting, the electronic voting system must be adapted to the different
systems used by users, such as, for example, internet navigators.

3.7.2.

Surrounding electronic voting with a certain solemnity and providing for

voting confirmation

Prior to the vote becoming final, the system must ask the voter for a double

confirmation both to surround the vote with a certain number of voting gestures demonstrating
the solemnity of the voter’s electronic voting act and so that he/she can ensure that a keying

error has not occurred. The voter must, therefore, have the option, provided that he/she has
not confirmed the vote, of changing the way in which he/she intends to vote.

3.7.3.

Supporting election players whilst electronic voting is implemented

It is necessary to support not only voters but also all the election players and, in

particular, the election candidates and administrators, whilst electronic voting is being

introduced, whatever the procedures used i.e. voting at a voting machine or distance voting.

The Internet rights forum therefore wishes the introduction of electronic

voting to be accompanied by information and training initiatives

. These initiatives,

aimed at encouraging people to take on board information technologies and at citizenship

training, may be conducted within digital public spaces or within the scope of the ‘Citizenship
education on the internet’ project set up by the Department of Education on the initiative of

the Internet rights forum.

3.8.

Encouraging checks on voting operations

3.8.1.

Enabling the integrity of the voting system to be monitored

The Forum believes that a voting system’s integrity is only guaranteed to the

extent that it checks for the absence of compromises both upstream and
downstream from the polling operation

. This monitoring must be performed, for elections

of a political nature, by experts approved by the Ministry for the interior. A system is,

The Internet rights forum

26 September 2003

therefore, deemed to be just if the source code can be accessed, if the system cannot be

modified

and if an ‘a posteriori’ audit is implemented.

3.8.2.

Providing for storage of voting data

The Forum wishes voting data to be stored until judicial appeal deadlines have

expired so that they can be submitted before the election judge and the criminal
judge in the event of dispute or fraud

. On the other hand, the data should not be stored

longer than is required for this monitoring.

3.8.3.

Providing for the judge to have access to the data

Data storage procedures must make it possible for said data to be used by election

judges and criminal judges. The Forum recommends that data should be generated by the

service provider and stored in a safe place where there is no chance of any amendments being
made. In this respect,

the Forum wishes this place to be, for elections of a political

nature, the place where election reports are traditionally kept.

It must be possible for the judges simply to read this data to check for consistency and

to form an opinion regarding the methods used by the applicants, even if these are technical
methods. To do so, they must be able, if necessary, seek the advice of technical experts of

their choice.

The Forum recommends that servers should be located on national territory so

as to enable operations to be effectively monitored by polling station members and
deputies

as well as to enable intervention, if necessary, by the competent national

authorities.

3.9.

Evaluating the electronic vote

Public polls conducted using electronic voting must be the subject of special follow-ups

and evaluations. This type of follow-up and evaluation already exists in lots of countries. This

is, for example, the case in the United Kingdom by means of The Electoral Commission, an
independent body created by the British parliament in November 2000.

The Internet rights forum recommends,

for this reason,

the creation of an

electronic voting ‘observatory’.

This Observatory should be attached to the ‘Agence pour le

développement de l’administration électronique’ [Agency for the development of electronic
administration], taking into consideration the interdepartmental nature of its duties

This Observatory would have the following duties:

- to centralise information and lessons learnt from electronic voting experiments and to
conduct international research;

- to lend its expertise to ministries responsible for organising polls when voting systems for

public polls are being approved. It could also be consulted by relevant ministries regarding
voting systems proposed to them by private service providers;

- to evaluate electronic voting systems used during major public polls at the request of the

ministries involved. This evaluation must, in particular, include a sociological aspect by

To this end, the CNIL uses the term

’sealing’

with regard to electronic voting systems, i.e. a

‘procedure enabling any

modification of this system to be detected’

(decision no. 03-036 of 1 July 2003).

According to the terms of decree no. 2003-141 of 21 February 2003 bringing about the creation of

interdepartmental services for State reform, the task of the ‘Agence pour le développement de l’administration
électronique’ is, in particular, to encourage the

‘development of public policy evaluation’

(art.2, paragraph 4).

The Internet rights forum

26 September 2003

COMPOSITION OF THE WORKING GROUP

Maurice BENASSAYAG

, Commissioner, French National Commission on Data Processing and

Liberties

Yannick BLANC

, Ministry of the Interior

Jean-paul

BOUCHET

, Trade union (CFDT Cadres)

Patrick CREFF

, Engineer, Ministry of the Interior

Fabienne

DAUTANT-BOUSSIN

, Ministry of Labour

Florence

DURAND-TORNARE

Association « Villes-internet »

François

FREBY

, Association « Club du e-Public »

Gilles GUGLIELMI

, Professor of Public law, University Panthéon-Assas

Régis

JAMIN

, Election.com

Eric MAIGRET

Bernard

MALIGNER

and

Laurence

MONNOYER-SMITH

, French National

Center for Scientific Research

Guy PRUNIER

, Project manager, Conseil constitutionnel

Thierry

VEDEL

, CEVIPOF

François

VERNAY

, Engineer, France Télécom

Contributors to the group:

Jean GONIÉ

Project Manager, Internet Rights Forum and

Mathieu

HERONDART

, Council of State