Privacy commissioner says internet voting too risky, as N.L. begins electoral reform

Newfoundland and Labrador should not adopt an online voting system, warns the province's privacy andinformation commissioner.

Michael Harvey madethe recommendation in a letter to Justice Minister John Hogan, who chairs an all-party committee reviewing the province's Elections Act, which hasn't been changed since 1991.

Under the current legislation, Elections N.L. cannot conduct online or telephone voting.

"In jurisdictions which have studied Internet voting in depth, and in particular those which have studied the security and privacy risks associated with it, grave concerns have been identified," Harvey wrote in the letter, dated Jan.21.

Harvey said he understands the government wants to avoid the chaos of the 2021 election, when in-person voting was cancelled due to an outbreak of COVID-19. Voter turnout in that election was the worst in the province's history.

Harvey argues that if the province implements an internet voting system, it will be more difficult to ensure that every voter is who they say they are and that the vote remains anonymous.

"Let's look at banking as the example. Identity management for banking is really critical. We need to be absolutely sure that it's you making the transaction," Harvey told CBC News on Wednesday.

"The same would be true for voting. For voting, anonymity is a second characteristic. Voting needs to be both verifiably you but each vote needs to be secret. Therisks associated with Internet voting, in our view, are simply too high."

A 2020 white paper prepared by the Office of the Information and Privacy Commissioneradds that with a digital system, voters would need to identify themselves with a username or code that would be tied to their ballot, leading to privacy risks.

Undermine public trust

The white paper a report or guide that informs readers concisely about a complex issue also warns that the adoption of online voting could undermine public confidence in the electoral system.

"Even if an election in this province is never successfully hacked and the electronic processes work as intended, will everyone believe it? If a surprise electoral victory occurs, will people say there was a bug in the system or that it was hacked?" the report reads.

The paper also states that while there are examples of online voting proceeding without any reported incidents, it is important to understand that system errors and hacks that threaten the integrity of the result may not be detected.

Harvey points to the recentvulnerability of government digital systems, highlighting the cyberattack that rocked Newfoundland and Labrador's health-care system last November.

"There are two types of organizations: those that have been hacked and those that don't know they've been hacked," Harvey said. "Cyberterrorists and cybercriminals are out there, and it's a part of the risk landscape. We will be investigating what happened with the cyberattack on our health system, but we also know from the onset that every system is vulnerable."

Harvey said the province shouldbe concerned if its core democratic system were vulnerable to people who might wish to destabilize an election.

Several studies detail the risks

In Canada, online voting does not exist at the provincial or federal level. However, some municipalities in Ontario and Nova Scotia have adopted an internet voting system.

In 2018, researchers at Western University and the University of Melbournestudied the flaws in online voting in Ontario and detailed the risks associated with the lack of physical traces to verify the results.

"No technical standards currently exist within Canada for designing, testing, or certifying online voting systems, nor auditing or otherwise independently verifying the result they produce. Nor do the federal or provincial governments provide guidance on the procurement and operation of such systems," the report reads.

The researchers also found that "there appeared to be little objective evidence either supporting or disputing a particular online election result beyond the clerk's declaration of results itself. None of the deployed online systems produced an accompanying paper trail, and there is currently no online equivalent of risk limiting audits."

In 2016, a special committee of the House of Commons noted "many Canadians are open to the idea of online voting as a way of making voting more accessible," but concluded "the secrecy and integrity of an online ballot cannot be guaranteed to a sufficient degree to warrant widespread implementation in federal elections."

In 2014, British Columbia also decided not to adopt an online voting system when an independent committee concluded that implementing such a system involves "significant risks."

In a statement to CBC News on Thursday, the Department of Justice and Public Safety confirmed it had received the letter. It saidwork is ongoing by the all-party committee and no decisions have been made.

Harvey will appear before the committee at its next meeting,on Feb. 23.

"It is important to hear from the privacy commissioner and to allow for the all-party committee to ask him questions directly on this issue,"said a department spokesperson.

Read more from CBC Newfoundland and Labrador