How does your system allow voting from multiple locations, prevent duplicate votes, prevent voters to be associated with their votes, etc?

It is funny, and perhaps lucky that they got the user interface work so badly botched. The user interface is the easy part. The hard part is getting the security right and the entire country-wide system reliable, and not allow any particular party (such as the vendor) steal the elections, or allow government to look at how you voted.

The system we used failed on all counts, but only the user interface problems were visible to the end-user. For instance, revealing votes: the government officials have keys to open the ballots and see who voted how. Luckily, they have promised not to look, so we can all sleep well now.

It is of course a completely correct decision from the supreme court to re-run the elections, and we are very happy about it.

But it has been interesting to follow the developments and the various attempts to avoid this outcome.

Before the elections, the minister of justice, Tuija Brax claimed any possible problems were "science fiction". After the elections and when the problems were announced, she has not been a support of new elections, just stating that the courts need to decide. However, she was quick to launch an internal investigation and fire the Director of Elections. Not sure the director was really the true guilty person here, but at least a scapegoat had been found...

The city voting boards very resisting new elections for the last second. They came up with interesting claims to prevent this from happening. One claim that we've heard often -- even after the decision -- is that the new elections do not matter, because the party situations would not change. Well, they were missing the minor issue that in Finland the election system is based on voting on persons, not parties. Some of us do care about who we vote there. A more sinister claim was that the voters had conspired to misuse the voting system on purpose, to show that it was unreliable (!). Now, talk about science fiction, maybe these guys could be of some use in the JFK murder investigation? Not to mention the fact that a correctly implemented voting system should not be vulnerable to such misuse.

The three cities involved are now extremely unhappy with the ministry, as the law requires them to pay for the new elections. The ministry has promised an extra budget to help out... though in my mind, the architects and vendors of the system should get to pay.

Its also been extremely difficult to get any information from the government on the details of the system. The local EFF wanted to take a look before the elections, but was refused (or impossible NDAs were requested). I made an official request to get the cost information of the entire project, and the government claimed that they have no such information. One number that has been circulated in the press was 700 000 euros, but that seems low, given that a large number of design and specification work went in, even at the ministry level not to mention the vendors.

All in all, a happy outcome:

- director of elections fired
- minister is now pro-open source and paper trail
- general knowledge of possible problems in e-voting was increased in the country :-)
- elections are re-run

However, everyone is quite focused on the specific bugs we experienced, thinking that individual bugs can easily be fixed. I'm more worried about the process and the way that these things are done. I don't see a way to avoid bugs next time either, for instance. Lack of verifiability, openness, government not listening to citizens or outside experts, blind acceptance of vendor sales pitches, lack of sensible motivation for the entire effort are the worrisome aspects.

Its actually surprisingly hard, if you start to think about it. If you compare to the paper ballot system, there are checks and balances. The different party officials and citizens can oversee the counting (in fact, they volunteer to do it). One corrupt counter does not break the system, however, because the others will catch him. And its very hard to cause a country-wide discrepancy.

If you compare an e-voting system to, say, a banking application, there's one big difference: in the banking application you WANT a secure trail of events, stored for perpetuity. In voting you want anonymous results while at the same time secure results. Its very hard to do this, as almost every design makes you trust someone in some way.

Then if you add the issue of voters not being able to verify the system for various commercial reasons... my take on this is that an e-voting system does not make sense for simple and efficient elections like the ones we have in Finland. Counting is fast, there are no reliability problems (in fact, there is a 10x higher reliability in paper ballots). Its cheap, because its mostly run by volunteers who have an incentive to participate.

The loss of a single vote might have affected the results, given the Finnish system.

My city was one of the affected ones. In our city there were candidates A and B who got the same number of votes, both on the margin that you need to get in, and only one place was left. Only one made it to the city council, based on a toss of a coin by the voting board. If there had been one more on vote on either one, the random selection would not have been necessary.

Remember that we are talking about local elections and elections of individuals as opposed to parties. The number of votes lost in my city was greater than the number of votes needed to get into the city council.

Please check YOUR facts first. There were several problems:

- bad user interface design
- machines freezing up at the critical moment
- machines crashing when presented with the voting card
- instruction leaflet asking the voter to press "OK" once when twice was needed
- secret, closed source design
- no paper verification
- no public review possible of the algorithms etc

Of course, the publicity around this case centers on the first issue, because its the easiest to understand. But there were other problems, too, just read the witness statements from the actual appeals.