← All posts

Two democracies, opposite answers on voting computers

Germany looked at a voting computer and asked: can every citizen check this? Estonia asked: can we make voting easier? Only one of those questions leads to a democracy you can actually verify.

It is the morning of March 3, 2009, and eight judges in Karlsruhe are reading a ruling into the record that will, within months, pull every voting computer out of every German polling station. Not because fraud was proven. Not because a single vote was shown to have been altered. But because of a question the machines could not answer.

Can an ordinary citizen, without specialist knowledge, verify that the count is correct?

The machines could not say yes. That was enough.

Meanwhile, in Tallinn, a different answer was quietly being built into national infrastructure. Estonia's internet voting system — i-voting — was growing election by election, year by year. Voters cast ballots from kitchen tables. Turnout climbed. The system was praised internationally. And then, in 2014, a team of independent security researchers sat down with the published client code and the videos of server operations that Estonian officials had released.

What they found was the other answer. The one Germany had refused.

What Germany actually decided — and why it was not about fraud

The German case began with a complaint about the 2005 federal election. Nedap voting machines had been used in parts of the country. The machines recorded votes in electronic memory. They produced no paper a voter could inspect. No independent record existed that could be checked after the fact.

The Federal Constitutional Court did not need evidence of tampering to rule against them. Its standard was not 'did fraud happen?' but 'could citizens have caught it if it did?'

The Court held that democratic legitimacy flows, in part, from the public nature of elections — what German constitutional law calls Öffentlichkeit der Wahl. Article 38, read together with Articles 20.1 and 20.2 of the Basic Law, requires that the essential steps of voting and result determination can be examined by citizens reliably and without specialist knowledge.

Closed software, votes stored only in memory, no voter-verified record: the machines failed every part of that test. The Federal Voting Machines Ordinance was unconstitutional.

Note what the Court did not do. It did not invalidate the 2005 election — it weighed the constitutional defect against the disruption of overturning a democratically elected parliament, and found no evidence of actual malfunction. But the machines were finished. Germany went back to paper ballots and manual counting.

The principle the Court articulated was not a technical judgment. It was a democratic one: a result that only an expert can verify is not a result a democracy has truly counted.

The Dutch had arrived at the same place two years earlier. Their Election Process Advisory Commission, in its 2007 report Stemmen met vertrouwen ('Voting with confidence'), put it plainly: there are no secrets in the election process — questions must be answerable, and the answers checkable and verifiable. The Netherlands returned to paper ballots. The regulations authorizing voting machines were withdrawn.

Two wealthy, stable European democracies, neither of them particularly technophobic, looked at unverifiable electronic voting and said: not good enough.

Estonia said yes — and built the world's most scrutinized online voting system

Estonia's i-voting system grew from a different tradition. A small nation that had digitized its entire government infrastructure — digital identity cards, online tax returns, electronic health records — saw internet voting as a natural extension of its digital state. By the time of the 2013 municipal elections, hundreds of thousands of Estonians were casting national ballots online.

Unlike the Nedap machines in Germany, the Estonian system at least published its client-side code. Officials released videos of server operations. There was genuine effort at openness — more than most online voting systems attempt.

And that openness was precisely what made the 2014 analysis possible.

An independent team — Springall, Finkbeiner, Durumeric, Kitcat, Hursti, MacAlpine, and Halderman — observed the system during the October 2013 municipal elections and examined the published software and server configuration. They documented what they found in a peer-reviewed paper presented at ACM CCS 2014.

The findings were serious.

Operational security during server preparation was visibly lax — captured in the very videos officials had released. The software architecture contained gaps. Most significantly, the researchers concluded that a well-resourced attacker — a nation-state, or a dishonest insider — could plausibly compromise the integrity of votes or voter privacy without detection.

Not 'could slow the system down.' Not 'could cause a visible crash.' Could alter votes. Undetectably.

Estonian election authorities disputed the conclusions. The dispute is real and ongoing, and the researchers' findings have not been adjudicated by any court. But notice the structure of that disagreement: it is a technical argument between security experts, conducted in peer-reviewed venues, precisely because the Estonian system was open enough for outside researchers to have something to examine.

The Estonian case is not a story of a corrupt election. It is a story of a system that invited scrutiny and then could not fully survive it.

Two assumptions, spelled out

Germany and Estonia made different bets, and it is worth naming them clearly.

Germany's bet: The legitimacy of a democratic election depends on ordinary citizens being able to verify the count. Any system that fails that test is unconstitutional regardless of whether it has ever malfunctioned.

Estonia's bet: Convenience, participation, and digital infrastructure matter. Independent expert review and published code are enough to establish trustworthiness.

Both bets are coherent positions. But they rest on fundamentally different conceptions of who gets to check the result — and how.

Germany's standard is radical in its simplicity: the citizen. Not the certified expert. Not the election authority. Not the vendor. The citizen standing in the polling station, or watching the count from the gallery, must be able to follow what happens to their vote without needing a computer science degree.

Estonia's standard is more modern, more flexible — and more dependent on trust. It assumes that if the code is published, experts can read it; if experts can read it, problems will surface; if problems surface, they will be fixed. That chain requires each link to hold. The 2014 research showed that at least one link — the ability to detect a sophisticated insider or state-level attack — was not demonstrably solid.

What the German Constitutional Court understood, and what the Dutch commission articulated, is that expert review is necessary but not sufficient. An election that requires you to trust a chain of experts is still an election built on trust, not verifiability. The difference matters most when the experts disagree — which is exactly what happened in the Estonia case.

The verification gap that no one debates enough

Here is the problem neither country has fully solved, stated plainly.

Germany's paper ballots and manual counts are verifiable in the sense the Court meant: you can watch a ballot being placed in a box, watch the box being sealed, watch the count. A citizen with no specialist knowledge can follow the essential steps.

But paper is not the last word on verifiability. The 2020 hand count in Georgia — five million ballots tallied by hand across 159 counties in less than six days — confirmed the machine tally to within about a tenth of one percent. That is impressive. It is also not the same as saying the hand count was error-free. In Antrim County, Michigan that same year, a hand audit of roughly 15,700 presidential ballots differed from the machine tabulation by about a dozen votes. Twelve votes, in a small county, after a manual recount.

Twelve votes sounds like nothing. In a race decided by fewer votes than that — which happens — a method that is itself off by a handful of votes cannot settle the question. 'The hand count confirmed it' is a reassurance, not a proof. Even the trusted gold standard carries irreducible human error.

Estonia's digital system, in principle, could do something paper cannot: generate a cryptographic proof that every counted vote was cast by an eligible voter and tallied correctly, without revealing how any individual voted. That is the promise of end-to-end verifiable cryptographic voting, and it is genuinely more powerful than counting paper by hand.

But the Estonia system did not fully deliver that promise. The 2014 researchers found that the cryptographic architecture, as implemented, left room for undetectable manipulation. Publishing the code was a necessary condition for finding this. It was not a sufficient condition for fixing it.

The Swiss federal internet voting system found this out the hard way in 2019. Swiss Post and its vendor Scytl published the full source code for public scrutiny. Independent researchers Lewis, Pereira, and Teague found a cryptographic trapdoor in the mixnet's shuffle proof — a flaw that would have let an authority who knew certain secret values generate a verification transcript that appeared valid while actually hiding altered votes. The flaw was invisible in a certified black box. It became visible the moment the code was published and real cryptographers looked.

Open code found the flaw. Open code was necessary. But open code alone did not make the system verifiable — it made the system auditable, which is a prerequisite for verifiability, not the thing itself.

What it would actually mean to solve this

The German standard — citizen verifiability without specialist knowledge — and the Estonian ambition — cryptographic proof of correctness — are not actually in conflict. They point toward the same destination by different roads.

The destination is a system where any voter, and any independent observer, can check that their vote was included in the count, that the count was computed correctly, and that no unauthorized additions or deletions occurred — without trusting the election authority, the vendor, or any single expert to tell them so.

Paper ballots, scanned and optically read, audited by hand under a risk-limiting audit protocol, come close to the German standard — but depend on the physical chain of custody being unbroken. Austria's Constitutional Court annulled a presidential election in 2016 not because fraud was found, but because the procedural safeguards around postal ballots had been violated in numbers that could have affected the result. A broken chain of custody is an unverifiable result, even with paper in hand.

Cryptographic end-to-end verifiable systems, if correctly implemented and independently verified, come closer to a technical proof of correctness — but depend on the implementation being sound, the code being inspectable, and the cryptography being correct. Switzerland found that a certified system can carry a hidden flaw that passes every official check.

The lesson is not that paper is better than cryptography, or vice versa. The lesson is that 'trust us' — in officials, in vendors, in experts — is the failure mode that every approach eventually produces if it is not replaced by something anyone can independently check.

That is a harder standard than any single country has fully met. Germany met part of it by insisting on citizen-legible transparency. Estonia tried to meet part of it through published code and expert review. Neither approach alone gets you to a result that is truly, independently, publicly verifiable.

The Norway internet voting pilot, run through 2013 and shut down in 2014, reached a simpler conclusion: trust that votes are not altered could not be secured, and the convenience did not deliver the promised turnout gain. Sometimes the right answer is to stop and wait for a system that actually solves the problem.

The question neither answer has closed

Here is what remains unsettled, stated as plainly as possible.

Germany's paper-and-manual-count system is the most citizen-legible voting method available. But it is not independently verifiable in a formal sense: a hand count can be wrong by a small margin, a chain of custody can be broken without leaving obvious evidence, and the citizen watching the count is trusting that the sealed bag they see is the one that contains the right ballots.

Estonia's i-voting system is audacious and, in some ways, more ambitious than anything Germany attempted. But the 2014 research team concluded that a sophisticated attacker could alter the national online vote undetectably. The authorities disputed that. Neither the authorities nor the researchers can prove the other wrong in a way that a non-expert citizen can independently check — which is, of course, exactly the problem the German Constitutional Court identified in 2009.

The gap that neither country has closed is this: a voting system that produces, for every election, a public, machine-readable, cryptographically verifiable record that any person with a laptop and time can check against the announced result — without trusting the software, the vendor, the officials, or any expert's assurance.

That system exists in research literature. It has never been deployed at national scale in a binding election with those properties fully intact.

Until it is, the choice between Germany and Estonia is a choice between two kinds of trust — trust in the citizen-legible process you can watch, and trust in the expert-legible proof you cannot fully follow. Both are better than nothing. Neither is the end of the argument.

The next time an official tells you an election was verified, ask: verified by whom, against what record, in a way I could check myself?

If the answer requires trusting someone, the work is not finished.

See how common this verification gap is across the world — country by country, method by method → /atlas

Read the two-minute version of why verifiability is not the same as security → /simple

Explore documented cases where the gap between announced results and checkable results mattered → /gaps

Sources

See all postsExplore the gaps