Individual Verifiability and Revoting in the Estonian Internet Voting System

Abstract

Individual verifiability remains one of the main practical challenges in e-voting systems and, despite the central importance of this property, countries that sought to offer it to their voters faced repeated security problems. In this note, we revisit this property in the context of the IVXV version of the Estonian Internet voting system, which has been deployed for the Estonian municipal elections of 2017 and for the Estonian and European parliamentary elections of 2019. We show that a compromised voter device can defeat the individual verifiability mechanism of the current Estonian voting system. Our attack takes advantage of the revoting option that is available in the Estonian voting system, and only requires to compromise the voting client application: it does not require compromising the mobile device verification app, or any server side component. This issue, which has been confirmed by the IVXV system designers, adds to an increasingly long list of failures to offer genuine individual verifiability in Internet voting systems deployed for government elections. It prompts for reinforced caution regarding the evidences that are offered regarding the verifiability of voting systems, especially when the verifiability is a property on which is based the decision to deploy a voting system in government elections.