← All posts

Why voting online is so much harder than banking online

Your bank lets you check every transaction. Your vote disappears by design — and the moment someone tries to fix that, they hand vote-buyers the receipt they've always wanted.

It is March 2019, and somewhere in the offices of Swiss Post in Bern, a decision is being made that looks like a triumph of democratic transparency. Switzerland's federal postal authority and its Spanish vendor, Scytl, are about to publish the full source code of their internet voting system — the one slated for binding national referendums. Anyone can read it. The public can check it. The engineers are proud.

Six weeks later, three independent researchers — Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague — publish a paper with a title borrowed from Magritte: Ceci n'est pas une preuve. "This is not a proof."

They had found a trapdoor buried in the system's cryptographic shuffle. The math generated a "proof" that all votes had been counted correctly. The proof verified. It passed every check. And it was a lie — because anyone who knew the trapdoor values could generate a proof that passed verification while having quietly rearranged the votes underneath it. The whole point of the system's "universal verifiability" claim was that you didn't need to trust anyone. That claim was false.

Swiss Post and Scytl acknowledged the finding. The system was suspended.

This is the sharpest version of the problem. But it isn't the only one. And it isn't even the hardest one. The deepest problem with internet voting has nothing to do with cryptography. It has to do with a design constraint that predates computers by 170 years.

Why your bank and your ballot box are built differently

When you check your bank balance, you are reading a number your bank is happy for you to see. When you dispute a transaction, your bank produces a record — timestamped, attributable to you — and you can verify it matches. You can call your bank. You can show the record to a lawyer. The whole system is designed around one assumption: the transaction is traceable back to you.

That is precisely what a ballot cannot be.

The secret ballot — invented in Australia in the 1850s and adopted across democracies over the following century — was not a privacy courtesy. It was a security system. The Australian Electoral Commission records the logic plainly: because people voted publicly, they were vulnerable to intimidation and coercion. The solution was a uniform, state-printed ballot marked in private, with no link between the paper and the person who marked it. Britain formalized the same principle in the Ballot Act 1872, ending the era of open voting specifically to collapse the market for vote-buyers. A US federal court put it in plain modern language in Rideout v. Gardner (2016): secret-ballot reforms were adopted to "combat widespread vote buying and voter intimidation" — because a buyer cannot enforce a purchase they cannot verify.

Here is the structural collision: a bank receipt makes a transaction provable; a ballot receipt makes a vote buyable.

If you could photograph your marked ballot and send it to someone to prove how you voted, you would have handed every employer, political boss, religious authority, or cash-in-envelope operative exactly the enforcement mechanism they need. The court in Rideout struck down a ban on ballot "selfies" on First Amendment grounds — but it acknowledged the mechanism explicitly. The photograph restores proof of purchase.

So when someone proposes internet voting and says "we'll give voters a receipt to verify their vote was counted," they are proposing, in the same breath, a vote-buying infrastructure. And when they say "we'll make it anonymous so no one can prove their vote to a third party," they are proposing a system where the voter cannot independently confirm their choice was recorded at all. You cannot have both. The physics don't allow it.

This is the fundamental tension. Everything else is a variation on this theme.

The 48-hour experiment that killed a pilot

In September 2010, the District of Columbia Board of Elections decided to run an internet ballot-return system for overseas and military voters. Before deploying it for real ballots, they opened it to public testing. Good instinct.

A University of Michigan team led by J. Alex Halderman found a software vulnerability and gained near-complete control of the pilot server in roughly 48 hours. They could change every ballot that had been cast. They could view secret ballots. As a demonstration, they programmed the system to play the University of Michigan fight song after each simulated vote. The intrusion went undetected by officials for days.

D.C. dropped the plan. The peer-reviewed paper was published at Financial Cryptography 2012.

The lesson officials drew was: internet voting failed a security test. The deeper lesson is what that test proved was possible: when a system's security rests on software hidden from adversarial review, the only way to know if it holds is to let adversaries try to break it. Washington did the right thing by opening the pilot. The result was a caught defect rather than a stolen election.

Most deployments are not tested this way. Most simply go live.

280,000 votes already cast before anyone noticed the hole

March 2015. New South Wales is mid-election. The state's iVote online system has already collected roughly 280,000 votes when J. Alex Halderman and Vanessa Teague sit down to analyze the running system from outside.

They find that iVote loads code from an external analytics server over a connection vulnerable to then-known TLS weaknesses — the kind of flaws being actively exploited that year under names like FREAK and Logjam. A network attacker positioned between a voter and the server could have manipulated votes and compromised ballot privacy. They also find that iVote's telephone-based vote-verification service — the feature designed to let voters confirm their ballot — is itself susceptible to manipulation.

The authorities' pre-election security review had cleared the system. The researchers found these problems during a live election, after a quarter-million votes were already in. A fix was deployed while voting was still underway.

The peer-reviewed analysis was published at E-Vote-ID 2015. The NSW Electoral Commission disputed the scope of the risk, as authorities tend to do.

Notice what the verification mechanism actually was: a telephone service that could itself be gamed. This is the receipt problem in its most concrete form. You cannot verify that your vote was recorded correctly by querying the same system that might have altered it. Any receipt generated by a compromised system is a receipt for the lie, not the truth. The only meaningful verification is one conducted by an independent party who can inspect the mechanism — not the output of the mechanism itself.

The trapdoor in the proof

Return to Switzerland in 2019. What makes that case so clarifying is not that the system was broken in an obvious way. It was broken in a way that was mathematically indistinguishable from correct.

The researchers — Lewis, Pereira, and Teague — found that the system's mixnet used a trapdoor commitment scheme for its shuffle proof. A mixnet is how internet voting systems try to preserve anonymity: votes are shuffled through multiple stages so that input and output cannot be linked. The system then generates a cryptographic proof that the shuffle was performed honestly and no votes were altered.

The proof verified. The math checked out. And the trapdoor meant that an insider who knew the trapdoor values could generate a perfectly valid-looking proof for a shuffle that had changed votes.

This is not a theoretical weakness. This is what "universal verifiability" looked like in a system scheduled for binding national referendums. The published analysis forced Swiss Post and Scytl to acknowledge the flaw and suspend the system.

The episode gives you the hardest version of the receipt problem. Because even if we set aside vote-buying — even if we imagine a world where a receipt wouldn't be used to coerce anyone — the receipt itself might be a proof of a count that never happened, and there is no way for the voter to know the difference. The cryptographic "proof you can check yourself" turned out to require a mathematics PhD to recognize as false.

Germany's Federal Constitutional Court articulated the standard in 2009 when it banned electronic voting computers whose inner workings only experts could assess: the essential steps of voting and determining the result must be examinable by ordinary citizens, without specialist knowledge. A cryptographic proof that passes verification while hiding altered votes is precisely what that standard is designed to exclude.

Estonia: the system a nation trusts, and what researchers actually found

Estonia is the country most often cited as proof that internet voting works. It has run a national i-voting system since 2005. Millions of Estonians have used it. It is genuinely pioneering.

In 2014, an independent research team — Springall, Finkbeiner, Durumeric, Kitcat, Hursti, MacAlpine, and Halderman — observed the system's operation during the October 2013 municipal elections and examined its published client software and server configuration. They found serious operational and procedural security weaknesses: lax practices captured in official videos, gaps in the software's architecture, and a conclusion that a well-resourced attacker — or a dishonest insider — could plausibly compromise the integrity of votes or voter privacy without detection.

Their ACM CCS 2014 paper recommended that Estonia discontinue the system. Estonia's election authorities disputed the conclusions. The system is still running.

That dispute is itself the point. Two credentialed parties with access to the same system reached opposite conclusions about whether it was safe. In paper-ballot systems, this argument can be resolved: open the sealed boxes, count the ballots again, compare. In an internet voting system with strong anonymity properties, the "count them again" step does not exist. There is no stack of ballots to recount. There is only the software's output, and the question of whether you trust it.

Norway tried internet voting in 2011 and 2013. The trials were discontinued in 2014 after finding that turnout did not increase and that trust that votes are not altered could not be secured. The convenience argument — the main reason anyone proposes internet voting — did not hold up empirically. And the verifiability argument collapsed for the same reason it always does: you cannot independently audit what isn't there.

The real asymmetry

Your bank keeps a ledger. The ledger is traceable to you. If anything goes wrong, you can compare your records to the bank's records to an arbitrator's records. The chain of custody runs straight from the transaction to your name.

A ballot-counting system runs in exactly the opposite direction. The ballot must be permanently separated from the voter's identity before it is counted. The chain of custody runs from the sealed box to the tally, with the voter's name nowhere in the counting room.

Those two requirements — independent verification of what was counted and permanent untraceability of who voted what — push against each other with a force that no software architecture has yet dissolved.

Paper-based systems manage an imperfect truce: the physical ballot is the voter-verified record, marked privately, deposited anonymously, stored in a sealed box, and countable by anyone who can look at a piece of paper. The Dutch government's 2007 Korthals Altes Commission called this "voting with confidence" — and then recommended returning to it, from electronic systems, because paper is what transparency and checkability actually look like in practice. The Netherlands has used hand-counted paper ever since.

Internet voting systems have not found the truce. The receipt that proves your vote was counted is also the receipt that proves how you voted. The proof that no votes were altered either relies on cryptography that most voters cannot evaluate — or, as Switzerland discovered, can be faked by an insider with mathematical knowledge the voter will never have.

The villain here is not a vendor, a party, or a government. The villain is the impossible demand: prove the count without proving the voter. That is the problem no software has solved, and it is why the bank analogy fails at the foundation.

What would actually make this checkable

This is not an argument that internet voting can never be improved. It is an argument about what "improved" would have to mean.

The Swiss case shows that publishing source code is necessary but not sufficient — the code was public, and the flaw still required three cryptographers to find. The NSW case shows that pre-election certification is not sufficient — the flaw was found during the election by outsiders the certification process had not included. The D.C. case shows that open adversarial testing works, but only if the test is run before real votes are at stake, and only if jurisdictions are willing to kill a system when the test fails.

The Estonia case shows that even contested expert opinion cannot be resolved the way a paper recount can. And the Switzerland case shows that a "verifiable" proof can be a proof of a fiction.

What would make internet voting checkable — genuinely checkable by someone other than the vendor, the authority, or a cryptographer on retainer — would require at minimum: published source code subject to ongoing adversarial review; cryptographic receipts that prove inclusion without proving choice, verified against a public bulletin board that any voter can query; and an independent audit mechanism that does not depend on the same system it is auditing. Researchers are working on these properties. None of them exist in a deployed national system today that has survived adversarial scrutiny without finding a critical flaw.

Until they do, the bank comparison is instructive for exactly the wrong reason. Your bank can give you a receipt because your transaction was never meant to be secret. Your vote was. That is a feature, not a bug — and it is the reason online voting is so much harder than it looks.

What is still not independently verifiable: whether any live internet voting system in production today can withstand a well-resourced insider attack without detection. The systems that have been analyzed by independent researchers — Estonia, NSW, D.C., Switzerland — each produced findings the authorities disputed or patched. No national internet voting system has been subjected to the kind of continuous, open, adversarial testing that would let an ordinary citizen — not a cryptographer, not a government official — confirm the count was correct.

What would make it checkable: mandatory public source-code publication, independently operated public bulletin boards, ongoing adversarial red-team access, and audit procedures that do not route through the system being audited. Those are the standards worth demanding.

See how verifiability gaps appear across different systems and countries →

Read the two-minute version of the internet-voting problem →

Sources

See all postsExplore the gaps