← All posts

Norway tried internet voting for years, then quietly walked away

Norway built a nationwide internet-voting system, ran it for two elections, watched the turnout stay flat — and then quietly pulled the plug because no one could prove the votes hadn't been touched.

It is the autumn of 2013, and in twelve Norwegian municipalities, voters are doing something that feels almost miraculous: casting their ballots from a kitchen table, a train seat, a hospital ward. No queue. No commute. Just a browser window and a few clicks, and — the government promises — your vote is counted exactly as you cast it.

Two years later, that promise is withdrawn. No fanfare. A ministerial statement, a line about "unresolved trust concerns," and the program is over.

Norway's internet-voting experiment is one of the most instructive failures in modern electoral history — not because anything visibly went wrong, but because nothing could be proved to have gone right.

The promise: convenience as a democratic value

The pitch for internet voting is always the same, and it is always sincere. Low turnout is a real problem. Polling stations are inaccessible to the elderly, the disabled, soldiers abroad, people working double shifts. If voting were as easy as buying a train ticket online, surely more people would do it.

Norway took this seriously. The trials ran as a supplement to paper voting during the advance-voting period — ten municipalities in the 2011 local elections, twelve in the 2013 parliamentary elections. Voters who wanted to vote online could. Voters who preferred paper could still use paper. The pilot was careful, limited, and run by a government with genuine intentions.

The turnout didn't move.

According to Norway's Ministry of Local Government and Modernisation, the trials did not lead to increased turnout. The people who voted online were, in the main, people who would have voted anyway — just through a different channel. The group hardest to reach — people disengaged from politics — was not reached.

That alone might have been enough to shut it down. But the Norwegian government said something more important when it discontinued further internet-voting pilot projects in 2014: trust that votes are not altered could not be secured.

Read that sentence again. Not: "we found evidence of tampering." Not: "the system was hacked." But: we could not prove to anyone's satisfaction that votes had arrived as cast.

That is a different kind of failure — and a harder one to fix.

What "trust that votes aren't altered" actually means

When you drop a paper ballot into a sealed box in a public polling station, a chain of custody begins. The box is watched. It is sealed in front of witnesses. It travels to a count, where scrutineers from every party can observe every ballot as it is sorted. The process is slow, labour-intensive, and imperfect — but it is observable. Anyone with standing can watch.

When you click "submit" in a browser window, something very different happens. Your vote travels across networks you do not control, enters servers you cannot inspect, is processed by software whose source code may be proprietary, and emerges at the other end as a number in a database. At no point can you confirm that what arrived was what you sent. At no point can an independent observer watch the journey.

This is not paranoia. It is physics and mathematics. Internet communication passes through infrastructure that can be intercepted, redirected, or quietly modified. End-to-end encryption helps, but only if the software on your device is honest — and you cannot check that either.

The researchers who looked closely at real deployed systems found exactly the problems theory predicted. A team led by J. Alex Halderman observed Estonia's i-voting system during the 2013 elections and concluded that a nation-state attacker or dishonest insider could compromise the integrity of votes without detection. The Estonian authorities disagreed — but the researchers' ability to make the argument at all rested on the fact that some of the system's code was publicly accessible. Where code is closed, even that scrutiny is impossible.

And in Washington, D.C. in 2010, the question was answered even more bluntly.

D.C. tested its internet-voting system publicly — and lost within 48 hours

Before deploying an internet ballot-return pilot for overseas voters, the District of Columbia's Board of Elections did something commendable: it ran an open public trial and invited anyone to probe the system.

A University of Michigan team led by Halderman — Scott Wolchok, Eric Wustrow, Dawn Isabel, and Halderman — accepted the invitation. Within roughly 48 hours, they had gained near-complete control of the pilot server. They could change every ballot that had been cast. They could view ballots that were supposed to be secret. As a demonstration, they programmed the server to play the University of Michigan fight song after each simulated vote.

Officials didn't notice for days.

D.C. dropped the system. The pilot's saving grace was that it was a test — real votes were not at stake. The lesson is not that internet voting is always defeated within 48 hours; the lesson is that the only thing standing between the D.C. system and a real attack was the city's decision to test it in public first. Private certification had not caught what a university team found in two days.

A system whose security depends on not being tested is not a secure system.

The New South Wales problem: flaws found during a live election

The D.C. trial at least failed safely, in a sandbox. New South Wales was not so lucky.

During the March 2015 state election, the iVote online system was used to cast approximately 280,000 votes — real, binding ballots in a live election. Halderman and Vanessa Teague analyzed the running system and found that iVote loaded code from an external analytics server over a connection vulnerable to known TLS weaknesses, such as FREAK and Logjam, which could have allowed a network attacker to manipulate votes and compromise ballot privacy.

The researchers also found that the separate telephone verification service — the mechanism voters were meant to use to confirm their vote had been counted correctly — was itself vulnerable to manipulation. The very tool meant to provide confidence could be gamed to show a voter a reassuring result while their actual vote had been altered.

A pre-election security review had cleared the system. The independent external analysis, run while real ballots were being cast, found what the internal review had missed.

The problems were fixed while voting was underway. But for however many of the 280,000 votes had already been cast before the fix was deployed, there is no way to confirm they were counted as submitted. The voters who used the verification service before the patch cannot know whether the confirmation they received reflected their real ballot.

That is the hard version of the Norwegian problem. Norway at least chose to stop before it got here.

Why Switzerland's cryptographic fix didn't actually fix it

You might be thinking: surely cryptography can solve this. If a ballot is encrypted end-to-end with a scheme that lets any independent observer mathematically verify the count without learning how anyone voted — that closes the gap, doesn't it?

Switzerland tried exactly that approach. In 2019, Swiss Post published the source code of an advanced cryptographic internet-voting system for public scrutiny — the kind of radical transparency that other systems have refused. Independent researchers Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague read the code.

They found a trapdoor.

The system's mixnet — the component that shuffles votes so they cannot be linked to individual voters — relied on a commitment scheme with a secret structure. An authority who held certain trapdoor values could generate a mathematical proof that looked valid and passed independent verification while having actually altered votes. The system claimed "universal verifiability." The trapdoor meant an insider with the right keys could defeat that claim while leaving the verification looking clean.

Swiss Post and Scytl acknowledged the finding. Swiss authorities suspended the system. The only reason the flaw was caught was that the code was published — and that skilled, independent cryptographers chose to read it.

Most internet-voting systems do not publish their code. Most do not invite independent cryptographers to probe them. Most offer "it passed certification" as the answer to "can I check?"

Certification is a process. It is not the same as verifiability.

The standard that all of this falls short of

In 2009, Germany's Federal Constitutional Court set down a principle that every internet-voting advocate should have to answer. The Court struck down the use of electronic voting machines because they stored votes only in electronic memory with no independently verifiable record — but the principle it announced was broader: the essential steps of the voting and of the determination of the result must be examinable by the citizen reliably and without any specialist knowledge.

Not examinable by cryptographers. Not examinable by government auditors. Examinable by citizens. Without specialist knowledge.

That is a test internet voting in any current form fails comprehensively. You cannot hand a grandmother a network-traffic log and ask her to confirm her vote was recorded correctly. You cannot give a factory worker a cryptographic proof transcript and have him verify it without a Ph.D. Even the systems that claim end-to-end verifiability require either trusting a software client you cannot read, or reading mathematics most people have never encountered, or relying on a verification channel that (as New South Wales showed) might itself be compromised.

Finland grasped an adjacent version of this lesson even for in-person electronic voting. In 2008, an e-voting pilot in three municipalities had a usability flaw: voters who didn't wait for a final confirmation step had their votes silently dropped. 232 votes were never recorded, against the voters' will. The Supreme Administrative Court annulled the elections in those municipalities and ordered fresh ones. The voters had no way to know their ballot hadn't been captured. The system gave no warning.

When a voter has no independent way to confirm their vote was counted, a flaw — mechanical, procedural, or adversarial — can be entirely invisible until someone looks at the aggregate numbers and notices something is off. And "noticing something is off" only works when the error is large enough to be implausible.

What Norway actually chose — and what it tells us

Read the Norwegian government's statement carefully and you will see something that most official announcements obscure. The ministry did not say the system had been compromised. It did not claim that votes were altered. It said trust that votes were not altered could not be secured.

That is an honest acknowledgment that the absence of evidence of an attack is not the same as security. It is the responsible default: if you cannot prove the process is trustworthy to the people whose votes depend on it, you do not ask them to trust it anyway.

The turnout finding matters too — not because convenience is irrelevant, but because it removes the utilitarian justification for accepting the trust deficit. If internet voting reliably and substantially increased participation, a democratic community might have to weigh a hard tradeoff. Norway's data made that tradeoff unnecessary: the convenience benefit was not there.

This is not a verdict that internet voting could never, in principle, be made trustworthy. It is a verdict that no deployed system has yet achieved the standard that trustworthy elections require: end-to-end verifiability that an ordinary citizen can check, independently, without trusting any server, any vendor, any official, or any mathematician's word for it.

The Dutch commission that recommended scrapping voting computers in 2007 put it plainly: there are no secrets in the election process, and the answers must be checkable and verifiable. That requirement does not become less important because the channel is a browser rather than a touch screen.

The thing that is still not verifiable — and what would make it checkable

Here is what Norway's closure of the program did not resolve: whether, during the two elections in which internet voting operated, any vote was altered in transit or at the server.

The answer is: we do not know. And we cannot now determine it. The logs, if they exist, are not public. The source code, if it was ever independently reviewed, produced no published finding. The verification mechanism available to voters at the time — if there was one — cannot now be run against ballots already cast.

That is the record of the Norwegian trial: valuable knowledge and experience, per the ministry's own words, but no public audit trail that would let anyone independently confirm what happened to those votes. The reassurance is the decision to stop, not any evidence that everything was fine while it ran.

What would make this checkable — for Norway, or for any jurisdiction considering online voting — is a system designed so that its verifiability does not depend on any official's or vendor's honesty:

  • Published source code, reviewable by any cryptographer at any time, not just before deployment
  • End-to-end verifiable cryptography in which voters can confirm their specific ballot was included in the final tally using a receipt that reveals nothing about how they voted — and in which anyone can verify the tally is constructed entirely from valid, included ballots
  • Independent public adversarial testing before any binding vote, on the model of what D.C. did (and what Brazil's election authority does routinely with its machines)
  • Instant, precinct-level, machine-readable publication of results the moment they are final, so that independent observers can reconstruct and check the count without waiting for an official summary

None of these are science fiction. Some exist in pieces in academic and experimental systems. None exist together in a deployed national internet-voting system that has been independently verified to work.

Until they do, "trust that votes are not altered" is not something any internet-voting system can honestly provide — and Norway was right to stop asking its voters to extend it.

The shareable version: Norway quit internet voting not because something went wrong, but because nothing could be proved to have gone right. Convenience without checkability isn't democracy — it's faith-based voting.

See how common this verifiability gap is across the world →

Read the two-minute version of why checkability matters →

Sources

See all postsExplore the gaps