← All posts

The world's most famous online-voting system, taken apart by researchers

Independent researchers watched Estonia's celebrated internet voting system run a live national election — and concluded a foreign government or a single corrupt insider could alter votes without anyone noticing.

It is October 2013, and somewhere in Tallinn, a server is receiving the votes of a nation.

Estonia has spent a decade building something no other country can match: a fully operational national internet voting system, used in real binding elections, casting real ballots that decide real seats in parliament. Estonians log in from their kitchen tables, their offices, their phones. The system has a name — i-voting — and a reputation: the world's gold standard for digital democracy.

What it also has, that autumn, is a group of independent security researchers watching it operate for the first time from the outside. They have come with credentials and cameras and a specific, uncomfortable question: can anyone verify that the votes being cast are actually the votes being counted?

A team of experts, a nation's ballots, and an open door

The team — Drew Springall, Travis Finkbeiner, Zakir Durumeric, Jeremy Kitcat, Harri Hursti, Jason MacAlpine, and J. Alex Halderman — observed Estonia's municipal elections in October 2013 and then examined the system's published client software and server configuration. Their paper was peer-reviewed and published at ACM CCS 2014, one of the most competitive computer security venues in the world.

What they found was not a theoretical critique of internet voting in the abstract. It was a specific, documented analysis of a specific, fielded system handling real national ballots.

Their conclusion: a well-resourced attacker — a nation-state, or a dishonest insider — could plausibly compromise the integrity of votes or voter privacy without detection.

Not "might be able to." Not "in an adversarial lab environment." A real, live national election. Undetectable interference.

The Estonian election authorities disputed the conclusions. That dispute is itself part of the story — and we will get to it. But first: how did the researchers get close enough to find any of this?

The thing that made the analysis possible

Here is the detail that changes everything: the system's code and procedures were at least partly public.

Estonia published enough of the i-voting software and server configuration that outside experts could actually evaluate real risks, rather than taking the government's word for it. This is not how most election technology works. Most voting systems — especially in the United States — are proprietary. The code is a trade secret. External reviewers, if they exist at all, work under non-disclosure agreements. The public is handed a certification and told to trust it.

Estonia's partial openness was, paradoxically, what let the researchers do their job. When code is hidden, all you can verify is the claim that it works. When code is public, you can test whether it actually does.

The researchers documented serious operational and procedural security weaknesses. They noted lax operational security practices — some of which were captured in official videos the Estonian authorities themselves had made public. They identified gaps in the software's architecture. And they walked through, step by step, how a sophisticated attacker could exploit what they found.

The Estonian authorities said the researchers had misunderstood the system, that the identified weaknesses did not translate into exploitable attacks, and that i-voting was safe. Those are claims. The researchers' analysis is also a claim. The crucial difference is that the paper was published, peer-reviewed, and specific enough that anyone with the relevant expertise could read it and form their own view.

An official press release saying "our system is secure" is not that. It never will be.

What "undetectable" actually means

Let us be precise about the word, because it does heavy lifting.

In the Estonian researchers' model, an attacker does not need to break into the room where votes are counted. They need to compromise the chain before the vote gets there — ideally on the voter's device, or on the server that receives and processes ballots.

A voter's personal computer is not a voting machine. It has not been inspected, certified, or hardened for election use. It may be running outdated software. It may already be infected with malware from an entirely unrelated phishing email. When your ballot travels from your laptop to a government server over the internet, the security of that ballot depends on the security of every system it touches — and you control almost none of them.

The researchers found that if a server component were compromised — by a nation-state attacker with the resources and motivation to do it, or by an insider with access — ballots could be altered in ways the existing audit mechanisms would not catch. The system's protections were not strong enough to close that gap.

This is not a theoretical attacker. Estonia shares a border with Russia. In 2007 — six years before this analysis — Estonia suffered one of the first large-scale state-linked cyberattacks in history, targeting government websites, banks, and media outlets. The researchers were not inventing a threat. They were measuring the gap between a real, documented geopolitical risk and a system's actual ability to withstand it.

Why official reassurance is not enough

When the Estonian National Electoral Committee responded to the 2014 paper, it argued that the researchers had not demonstrated an actual attack on a real election, and that the system had robust procedural safeguards.

This response is worth examining on its own terms, because it is structurally identical to the response election authorities give almost everywhere, almost every time.

We found no evidence of tampering.

Our certification process was thorough.

Observers were present.

The result was confirmed.

These statements may all be true. They do not answer the researchers' question. The question is not "did tampering happen?" The question is: "If tampering had happened, would anyone have been able to tell?"

And for an internet voting system where the attacker operates on the server or on millions of individual voter devices, the answer the researchers gave — carefully, with evidence — was: probably not.

Germany's Federal Constitutional Court wrestled with an analogous problem in 2009, when it banned electronic voting machines whose correctness could only be evaluated by specialists. The court's standard was bracing: the essential steps of the voting process must be examinable by the citizen reliably and without specialist knowledge. A machine you have to trust because you cannot check it fails that standard. An internet voting system where the audit trail lives on a server you cannot inspect fails it too.

The German court did not need to prove the Nedap machines had been tampered with. It needed only to establish that tampering was unverifiable. That was enough.

Estonia's authorities never had to meet that standard in a court. The researchers' paper stands in the record regardless.

The comparison that sharpens the point

Consider two cases from the same era and the same general category — internet and remote voting systems evaluated by external researchers.

In 2010, the District of Columbia ran an open public trial of an internet ballot-return system and explicitly invited independent experts to probe it. A University of Michigan team led by Halderman gained near-complete control of the pilot server within roughly 48 hours. They could change all ballots that had been cast. They could view secret ballots. Officials did not notice for days. D.C. dropped the system before any real ballots were at stake. The findings are published.

In 2015, during a live election in New South Wales, Australia, where roughly 280,000 votes had already been cast online, Halderman and researcher Vanessa Teague found that iVote loaded code from an external analytics server over a connection vulnerable to known TLS attacks — which could have let a network attacker manipulate votes. The system's own telephone-based verification service was itself susceptible to manipulation, which meant the designed check on integrity could be gamed. A pre-election security review had cleared the system. The paper is published.

The pattern is not coincidental. External, independent, adversarial review — conducted by people who have no institutional interest in the answer being "it's fine" — finds things that internal certification does not. Every time.

This is what the 2014 Estonia analysis represents. Not a partisan attack on a small nation's democratic institutions. A peer-reviewed paper from credentialed researchers who looked at a real system and reported what they found.

What "partly public" got us — and what it still could not prove

Here is the hardest part of this story to sit with.

The Estonia analysis was possible because the code was partly public. Researchers could read the software, watch the operational videos, examine the server configuration. That openness is what turned "unverifiable claim of security" into "evaluable specific argument." It is already far more transparent than most commercial voting systems.

And yet partial openness is not the same as full verifiability.

A voting system where a researcher can read the code but cannot verify what code is actually running on the election server on election night still has a gap. Publication of source code tells you what the system is supposed to do. It does not prove what the live deployed system is doing while the votes come in. Server logs can be altered. Deployment environments differ from reviewed code. An insider who compromises the server after the code review has changed nothing the review would catch.

This is the design problem that internet voting has not solved — and that every serious cryptographer in the field will tell you it has not solved. The channel between a voter's personal device and a government server is not a controlled, tamper-evident environment. It is the entire internet, plus every piece of software on millions of private computers, plus every person with administrative access to the election infrastructure.

Switzerland published its i-voting source code in 2019 for public scrutiny, and independent researchers Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague found a cryptographic trapdoor in the shuffle proof — a flaw that allowed an authority who knew the trapdoor values to generate a proof that looked valid while actually having altered votes. The flaw was invisible in a certified closed system and became findable only when the code was published. The paper documents it precisely. Swiss authorities suspended the system and fixed it. That is the right response. But it only happened because a public code release let outsiders find what internal review had missed.

The lesson is not that open source is sufficient. It is that open source is necessary — and not yet enough.

What would actually make this checkable

The deeper issue the Estonian case surfaces is a design requirement, not a flaw in a particular implementation.

A voting system that anyone can verify must do more than publish its code. It must produce, for every vote, a public, independently checkable record that proves the vote was counted as cast — without revealing how any individual voted. The branch of cryptography that attempts this is called end-to-end verifiable (E2E) voting. Systems in this family give each voter a cryptographic receipt they can use to confirm their specific ballot appears in the published tally, and they produce a public proof that the tally is computed correctly from those ballots. The proof can be checked by anyone, including researchers who distrust the vendor and the government.

No such system was in place for Estonia's i-voting in 2013. The researchers' recommendations included discontinuing use of the system pending fundamental security improvements. Estonia did not discontinue it. As of this writing, i-voting remains in use.

That is a factual statement, not a verdict. Estonian authorities believe the system is secure enough to run. The researchers believe the published evidence supports a different conclusion. The public — Estonian and otherwise — has no mechanism independent of trusting one of those two positions.

That is the problem. Not "Estonia did something wrong." The problem is that trusting a result and verifying a result are different things, and one of them does not protect you if the authority you are trusting is the one that has been compromised.

The question nobody has answered

Norway ran internet voting pilots in 2011 and 2013, concluded the trials did not lead to increased turnout, and quietly ended the program in 2014. The Ministry noted the trials had "produced valuable knowledge and experience" — a diplomatic phrase for: we learned things we did not like.

Finland ran an electronic voting pilot in 2008, and 232 votes silently vanished because of a confirmation-step flaw that faulty instructions hid from voters. The Supreme Administrative Court annulled the elections in three municipalities and ordered them run again. Finland did not continue with electronic voting.

The pattern here is not that internet or electronic voting is always catastrophically wrong. The pattern is that when an independent body — a court, a research team, a government commission — gets access to real evidence and asks hard questions, the answer is almost never "it works as advertised and here is the proof." The answer is almost always some version of "we found things the certification process did not catch, and the public had no way to check."

The question that Estonia's 2014 analysis leaves open is this: If an attacker with nation-state resources had compromised i-voting in Estonia's municipal or parliamentary elections, what would the evidence look like, and who would be able to find it?

The Estonian authorities' answer is: the procedural safeguards would catch it.

The researchers' answer is: the procedural safeguards are the part we are worried about.

Nobody has published the proof that would settle the question. That proof does not currently exist. And in an election, an unresolved question about whether a result reflects the actual votes cast is not an academic puzzle. It is a democratic problem.

The shareable takeaway is this: "The system is secure" and "here is the independently verifiable proof that the system is secure" are not the same sentence. One of them protects democracy. The other just asks you to trust.

Open code turned an unfalsifiable official assurance into a testable claim. That is progress. But a testable claim is only as good as the mechanism that lets anyone — not just credentialed researchers with access to official videos — run the test on election night, not three months later in a conference paper.

That mechanism does not yet exist for internet voting, anywhere. And until it does, "our security review was thorough" is a starting point for scrutiny, not the end of it.

See how this gap shows up in voting systems around the world →

Read the two-minute version of the verifiability problem →

Browse documented cases of unverifiable election results →

Sources

See all postsExplore the gaps