Now is the time to regulate voting technologies in Canada

Nicole Goodman is an associate professor of political science at Brock University where she holds the Chancellor’s Chair for Research Excellence. Aleksander Essex is an associate professor of software engineering and cybersecurity at Western University where he leads the Western Information Security and Privacy Research Laboratory.

Canadian elections at provincial, territorial and municipal levels have grown increasingly digital. We have seen the introduction of electronic poll books, electronic tabulators, and online and telephone voting. The COVID-19 pandemic has accelerated this process. As a result, there has never been a more crucial time to regulate voting technologies.

A recent report by the Communications Security Establishment emphasized that migrating elements of the democratic process online has increased the “cyber threat surface” of our democracy. Elections are a key part of this trend.

In Canada and around the world, elections and referendums have been postponed or modified because of the pandemic. Despite increasing vaccine rates in developed countries, public-health concerns persist and safety measures will likely continue for some time, meaning governments will need to consider voters who may not be able to attend polls in person or feel comfortable doing so. Many jurisdictions have been looking to new technologies to promote voting equality, which can be vulnerable around times of crisis when certain electors may be disproportionately affected.

At the same time as governments consider expanding voting methods, a growing number of companies are bringing their services to market. In the 2018 Ontario municipal elections, four companies deployed online, telephone voting and electronic tabulators. The number of vendors bidding on contracts has ballooned to 14 in advance of the 2022 elections. With this shift we are seeing new approaches that haven’t been used in the real world yet, and older ones that are due for updates still in use.

While choice is not a bad thing, online voting has long been controversial among cybersecurity experts, as growth is often accompanied by additional risk exposure.

We have already seen such cyber incidents in Canada. In the 2018 Ontario municipal elections, the voting websites of 43 municipalities slowed or stopped working. A statement from the vendor attributed the issue to an unauthorized limitation on bandwidth. Unfortunately, it went undetected until election night. Many cities had no backup plan, leading 35 of them to invoke emergency powers and extend the election by a full day. Eight others extended voting by one to two hours.

We also need to be forward-thinking so that we have frameworks in place for crises such as natural disasters. Last-minute adoption of technologies often goes badly, as New Jersey officials realized after rewriting procedures to allow for e-mail voting after Hurricane Sandy in 2012. There was mass confusion among officials and voters, uncertainty about the number of ballots submitted by e-mail and fax, and claims that the measures violated state law.

Canada must be prepared from a technological and regulatory standpoint. The first step is recognizing the opportunity and building political will. When it comes to the digital space, policymakers and elected officials in this country tend to be reactive rather than proactive. However, from crisis comes opportunity. Our current circumstances have created the space to have long-overdue discussions on regulation.

There are regulation models from which Canada can learn, but many are either too broad, too specific, or have gaps. The United States, for example, has a strong record of voting machine certification, and there is good uptake among states, but there is no regulation of e-mail or fax voting, which is used for military and overseas voters. Nor are there standards that apply to online voting. Any approach taken in Canada needs to be comprehensive and not leave us with vulnerabilities.

Working with practitioners and academics in both the social sciences and computer science can help build a body of knowledge to inform and prioritize legislation. Any approach to regulation needs to be rigid enough to mitigate risk while also being sufficiently flexible to not stifle innovation.

Canada has an opportunity to learn from the many communities that actively deploy voting technologies. We, the authors, have partnered with the CIO Strategy Council, a national non-profit accredited by the Standards Council of Canada, to develop voluntary standards for online voting use in municipalities. The process is under way and open for stakeholder involvement. It is a first step toward thought leadership on regulation, but further steps will need to be taken.

The work that governments and election officials do now will influence their ability to adapt in future elections, to promote voting integrity and ultimately to see to the health of our democratic elections.

Keep your Opinions sharp and informed. Get the Opinion newsletter. Si