L 132 - 2012-13 - Bilag 1: Høringssvar, og høringsnotat, fra økonomi- og indenrigsministeren

Technical dialogue on system for e-voting inDenmark – Summary reportRapport om teknisk dialog om et e-valgsystem i DanmarkDansk resuméPå baggrund af en skriftlig anmodning af 27. januar 2012 fra borgmestrene i 12 aflandets kommuner samt formanden for KL om tilladelse til at afholde bindende forsøgmed e-valg ved lovbestemte fremmødevalg besluttede regeringen den 6. marts 2012at fremsætte et lovforslag, der vil tillade kommunerne at afholde forsøg med digitalstemmeafgivning og digital stemmeoptælling, hvor resultatet af afstemningen er bin-dende.Grunden hertil er, at det vil kræve en ændring af valglovgivningen, hvis kommunerneskal have mulighed for at gennemføre forsøg med digital stemmeafgivning, hvor resul-tatet af afstemningen er bindende, da den danske valglovgivning forudsætter, at af-stemningen foregår med en papirstemmeseddel og en eller anden form for skrivered-skab. Økonomi- og Indenrigsministeriet vil fremsætte et lovforslag om digital stemme-afgivning og digital stemmeoptælling i januar 2013.Som et led i forberedelsen af den lovgivningsmæssige proces og det efterfølgendeudbud ønskede ministeriet forinden at undersøge de muligheder, som markedet aktu-elt kan tilbyde, og at få et overblik over de økonomiske konsekvenser af at introduceree-valg i Danmark. Ministeriet har derfor afholdt en teknisk dialog med 7 leverandører iperioden 21. august – 3. september 2012. Den tekniske dialog blev gennemført ioverensstemmelse med reglerne i EU's udbudsdirektiv og de retningslinjer, der erbeskrevet i informationsnote nr. 2012/S 122-201846 af 28. juni 2012.De 7 leverandører blev udvalgt blandt i alt 11 ansøgninger på basis af deres doku-menterede erfaring med udvikling, implementering og betjening af elektronisk stem-meafgivnings- og stemmeoptællingssystemer ved valg til folkevalgte organer. Leve-randørerne blev informeret om, at et fremtidigt e-valgsystem i Danmark alene vil bliveanvendt til fremmødevalg i et kontrolleret miljø på afstemningssteder på valgdagenog/eller til brevstemmeafgivning i kommunen, ikke til stemmeafgivning via internetteteller andre fjernvalgskanaler.Den tekniske dialog har efterladt ministeriet med det indtryk, at der findes mange leve-randører, der beskæftiger sig seriøst med e-valg, og som bringer kunden en vidtstrakterfaring på området, idet mange leverandører har arbejdet med at udtænke og leveredigitale stemmeafgivnings- og stemmeoptællingsløsninger igennem en række år. Deleverandører, der var indbudt til den tekniske dialog, har været involveret i at levere e-valgløsninger til lovbestemte valg i mange forskellige lande i verden og til et størreantal organisationer.

Ifølge de leverandører, der deltog i den tekniske dialog, kan man særligt fremhævefølgende fordele ved at anvende et digitalt stemmeafgivnings- og/eller digitalt stem-meoptællingssystem:A. Hurtigere stemmeoptælling og resultatberegning samt reducering af admini-strative ressourcer til manuel stemmeoptælling.B. Mere præcis stemmeoptælling og resultatberegning.C. Vælgeren kan gives mulighed for at verificere, at stemmenindgår i stemmeop-tællingen.D. Handicappede vælgere kan gives mulighed for at stemme uden hjælp.E. Utilsigtet ugyldige stemmer kan så godt som elimineres samtidig med, at mu-ligheden for at afgive en blank stemme kan opretholdes.F. Mulighed for ekstra ‘back-up’ lagring af stemmesedler.Ifølge de konsulterede leverandører er den største risiko eller ulempe ved at introdu-cere og anvende digital stemmeafgivning og/eller digital stemmeoptælling ikke såmeget et spørgsmål om tekniske fejl eller sikkerhedsmæssige aspekter, men mere etspørgsmål om vælgerensperceptionogtillid.Af den grund anbefaler nogle af de konsulterede leverandører, at man introducerer e-valg i små skridt, hvor man i første omgang anvender systemet i beskeden målestokog giver vælgerne tilstrækkelig tid til at vænne sig til ændringerne, og derved giverdem tillid til systemet ved at lade dem se det virke på en tilfredsstillende måde igen-nem flere valg og afstemninger, før det evt. rulles ud på landsdækkende plan.De økonomiske udbydere arbejder i forskellige lande med et vidt spænd imellem derespektive valgsystemer. Den vigtigste erfaring som leverandørerne har opnået der-ved var, at der ikke er to valgsystemer, der er ens – nogle gange ikke engang indenfor det samme land (f.eks. i USA).Alle de leverandører, som ministeriet har konsulte-ret, kan derfor levere skræddersyede løsninger og anvender en modulær metodik,dvs. hvor systemet kan sammensættes efter kundens ønsker ud fra nogle basisele-menter.Der findes ikke nogen ufejlbarlig løsning, der blot kan tages ned fra hylden og anven-des med succes til e-valg i ethvert land, inklusiv i Danmark. Derfor skal Danmark, hvisder gås videre med planerne om at gøre egne erfaringer her i landet med e-valg, fore-tage en række beslutninger om, hvilket e-valgsystem, Danmark ønsker, herunder omDanmark skal vælge en løsning, som genererer en fysisk manifestation af stemmen(print af stemmen), eller gå efter en løsning med en optisk scanner, der kan optælleen manuelt udfyldt stemmeseddel digitalt og generere et samlet resultat på baggrundheraf.Andre forhold, der ifølge leverandørerne skal overvejes, er for eksempel:fordele og ulemper ved at vælge en løsning baseret på dedikeret hardware,der alene kan anvendes til e-valg, over for standardhardware som f.eks. tab-lets, pc’er m.v.,hvordan stemmerne skal registreres (f.eks. i selve stemmemaskinen eller afet scanningsmodul koblet til stemmekassen),hvorvidt – hvis der vælges en stemmemaskine, der producerer en fysisk ma-nifestation af stemmen (print af stemmen i menneskelig læsbar form eller lig-nende) – vælgerne skal have mulighed for også at verificere indholdet af enevt. stregkode, som maskinen måtte printe sammen med det menneskeligtlæsbare stemmevalg,hvilke funktionaliteter til handicappede vælgere systemet skal tilbyde,

ContentsExecutive summary........................................................................................................ 41. Introduction ............................................................................................................. 62. Purpose of the technical dialogue........................................................................... 83. The official announcement...................................................................................... 84. Selection of participants and procedure for the technical dialogue ........................ 85. Framework and meeting agenda ............................................................................ 96. Demonstration of solutions ................................................................................... 117. Questions discussed............................................................................................. 137.1. Protection of privacy and the secrecy of the vote.............................................. 137.2. Dedicated versus non-dedicated hardware ....................................................... 147.3. Voter-verifiable paper audit trail (VVPAT) ......................................................... 147.4. Security and safeguarding ................................................................................. 157.5. Accessibility for the disabled.............................................................................. 167.6. Economic implications ....................................................................................... 177.7. Innovation, agile methodology and possibilities for further development(transferability) ............................................................................................................. 187.8. Scalability and separation of functionalities ....................................................... 198. Advantages and risks/disadvantages of electronic voting and counting .............. 199. Conclusion: Choices have to be made ................................................................. 21

Executive summaryFollowing a written request of 27 January 2012 from the mayors of 12 municipalities inDenmark and Local Government Denmark (KL)for permission to conduct binding trialswith e-voting at statutory elections, the Danish government decided on 6 March 2012to introduce a Bill to the Danish parliament that will allow the municipalities to conducte-voting pilots, where the result of the poll is binding.The reason for this is that the Danish election legislation will have to be amended inorder for the municipalities to be able to conduct binding e-voting pilots, as the lawcurrently implies that voting for statutory elections is done by using a paper ballot andsome sort of writing utensil. The Minister for Economic Affairs and the Interior will in-troduce a Bill to the Danish parliament in January 2013.As part of the preparation of the legislative and subsequent tender processes, theMinistry of Economic Affairs and the Interior wished to explore the possibilities that themarket has to offer at this point in time, and to get an overview of the economic impli-cations of introducing e-voting in Denmark. The Ministry has therefore conducted atechnical dialogue with 7 economic operators in the period of 21 August – 3 Septem-ber 2012.The dialogue was carried out in accordance with the rules of the EU Pro-curement Directive and the lines indicated by information notice no. 2012/S 122-201846 of 28 June 2012.The 7 economic operators were selected out of a total number of 11 applications onthe basis of their documented experience with development, implementation and op-eration of electronic voting and counting systems for elections to popularly electedorgans.The economic operators were informed that a future e-voting system in Den-mark will be used only for non-remote electronic voting in a controlled environment atpolling stations on election day and/or for advanced voting on the premises of themunicipalities; not for voting over the internet or by other remote voting channels.The technical dialogue has brought to the Ministry the recognition that there are manyeconomic operators working seriously with e-voting that bring to the customer a wideexperience in the field and which have been designing and providing e-voting and e-counting solutions for a number of years. The economic operators invited to the tech-

nical dialogue have been involved in providing e-voting solutions for statutory electionsin many different countries in the world as well as for numerous organisations.In the opinion of the economic operators participating in the technical dialogue, thefollowing main advantages can be derived from employing a digital voting and/orcounting system:G. Faster count and results + reduction of administrative resources for manualcountH. More accurate count and tallyI. Voter verifiability that the vote has been countedJ. Provides the disabled with the opportunity to vote without assistanceK. Eliminates involuntarily spoiled ballots while keeping the option to cast a blankvoteL. Additional ‘back-up’ storage of ballotsThe Ministry recommends that the municipal councils which are considering to engagein e-voting pilots have a thorough discussion of these and other possible potentialbenefits of e-voting and/or e-counting, and ultimately decide which of these should beguiding for the municipalities’ overall strategy for conducting e-voting and/or e-counting pilots.In the opinion of the consulted economic operators, the greatest risks or disadvan-tages of introducing and employing e-voting and/or electronic counting is not so mucha question of technology flaws or security issues, but more ofperceptionandtrust.For this reason, some economic operators recommend introducing e-voting by a step-by-step approach, starting out slowly and giving the voters sufficient time to familiarisethemselves with the changes and get to trust the system by seeing it work in a satis-factory way in numerous elections.All economic operators that the Ministry has consulted can provide customized solu-tions and employ a modular methodology. The economic operators operate in severaldifferent countries with a large variety of election systems, where the lesson learnedand imparted to the Ministry during the technical dialogue is that no two election sys-tems are the same, sometimes not even within the same country (e.g. USA).There is no ‘fool proof’ ready-made solution that can just be picked off the shelf andemployed successfully for e-voting in any given country, including Denmark. Hence, ifDenmark proceeds with the plans to make its own experiences with e-voting, a num-ber ofchoiceswill have to be made,inter aliawhetherweshould opt for a solution thatgenerates a ballot, or opt for an electronic optical ballot scanner solution with a count-ing and tallying functionality.Other things to consider are for example the pros and cons of choosing a dedicatedversus a commodity hardware solution, how the votes should be recorded, e.g. on thee-voting machine or by a scanning device connected to the ballot box, whether – ifopting for a ballot generator of some kind – voters should be offered the opportunity toverify not only the human readable imprint of their vote, but also any electronic record(bar code or similar), the kind of accessibility functionalities the e-voting solutionshould offer for the disabled, whether it should be a requirement that the system isopen source, and to what extent, and the intended use of the system: is it just for vot-ing at polling stations on election day, or should it also be able to handle mobile ad-vance voting in a controlled environment?

This report contains a summary of the information received during the technical dia-logue between the Ministry of Economic Affairs and the Interior with 7 economic op-erators on a system for electronic voting in Denmark, as well as a short description ofthe technology demonstrated by the economic operators. In addition, the report in-cludes a tentative estimate of the probable economic implications of introducing e-voting in Denmark for statutory elections based on the data delivered by the economicoperators in the technical dialogue.Following a written request of 27 January 2012 from the mayors of 12 municipalities iniDenmark and Local Government Denmark (KL) to be allowed to conduct binding trialswith e-voting at statutory elections, the Danish government decided on 6 March 2012to introduce a Bill to the Danish parliament that will allow the municipalities to conducte-voting pilots, where the result of the poll is binding.The Minister for Economic Affairs and the Interior, whointer aliais responsible for allstatutory elections in Denmark, stated the following in her press release of 13 April2012 on the government’s decision to allow pilots on electronic voting:

“We have to modernise the public sector, which makes it natural to exploit the op-portunities offered to us by new technology – also with regard to elections. The pi-lots will show whether e-voting offers any significant benefits, which can entail thatwe should consider digitalising the polling in the longer term.One of the benefits is that e-voting can eliminate the pile of spoiled ballots, wherethe election officials are in doubt about where the voter intended to cross the bal-lot. Another benefit is that e-voting will enable the visually impaired to vote withoutassistance. Also, e-voting can render the manual count unnecessary on the longerrun, which can save the municipalities some resources.The challenge is whether it is possible to make e-voting secure enough and keep itwithin an over-all proper financial framework, which the pilots shall also contributeto clarify. I hope that the municipalities will draw some good experiences from thee-voting pilots so that the technology can be spread out to the whole country.”MargretheVestager

Before the government and municipalities can move on to a procurement process, theDanish election legislation will as mentioned before have to be amended, as it cur-rently implies that voting for statutory elections is done by using a paper ballot andsome sort of writing utensil. The Minister for Economic Affairs and the Interior will con-sequently introduce a Bill to the Danish parliament, currently scheduled for January2013.Purpose of e-voting pilots from the municipalities’ point of viewIn their letter of 27 January 2012, the 12 municipalities stated that the overall purposeof carrying out one or more e-voting pilots would be to obtain experience with e-votingin a Danish context that could feed into the decision process re. a more general intro-duction of e-voting in Denmark. The municipalities therefore stressed the importanceof a thorough evaluation following the first pilots. The evaluation shouldinter aliafocuson technical security, possibility of independent auditing and public control and the

voters’ experiences related to the employment of an e-voting system with the aim ofsecuring public acceptance of digitally supported elections.The aim of the municipalities with regard to conducting the first binding e-voting pilotsare in particular to establish whether e-voting can:improve the accessibility for voters with disabilities, in particular for the blindand visually impaired as well as dyslectics, and to enable more voters to voteindependently,eliminate the involuntarily spoiled votes (i.e. not the blank votes, which shouldstill be allowed),be carried out while retaining a high degree of public control and high systemand operational reliability,make the recount redundant, or at least lead to a reduction of the administra-tive resources deployed for the count and recount,result in cost improvements for the municipalities on the longer run.

The starting point of the municipalities was thus to gain some experiences on the op-eration of a system for electronic ballot generating to be employed at the polling sta-tions and/or for advance voting in a controlled environment, and that offers specialaccessibility functionalities for the disabled and can provide an electronic count andtally.In order to increase the Ministry’s and the municipalities’ firsthand knowledge of differ-ent e-voting solutions to the challenges mentioned above it was decided to engage ina dialogue with key stakeholders at this early stage about the advantages andrisks/disadvantages of e-voting and which requirements should be made to allow e-voting in a Danish context, and to get an overview of different e-voting solutions.Process preceding the technical dialogueAs a first step, the Ministry organised a workshop on 15 May 2012 in collaborationiiiwith the Demtech research project at ITU (IT-University of Denmark) and the DanishBoard of Technology with the participation of more than 40 representatives from theIT-community, the municipalities, IT- and social sciences researchers, election ex-perts, interest organisations forinter aliathe disabled, civil and human rights, the eld-erly, etc. The purpose of the workshop was to engage key stakeholders as early aspossible in the process and gather their input on the desired requirements for a futuree-voting system in Denmark, including the necessary procedures for the preparation,safeguarding and carrying out of electronic voting and -counting.The Ministry works in close collaboration with the municipalities and participates in thesteering committee set up by the 12 municipalities and KL to monitor the e-voting pro-ject. In consultation with the steering committee, the Ministry decided in the late springof 2012 to conduct a technical dialogue with economic operators in the field of elec-tronic voting to acquaint itself with the current technological solutions.In return for the commitment of the Danish government to introduce a Bill that willpermit those municipalities that wish to do so to employ electronic voting and countingat statutory elections, the Minister for Economic Affairs and the Interior has asked themunicipal councils of the 12 municipalities that originally applied for permission tostconduct e-voting pilots for a binding declaration by the 1 of October 2012 of theircommitment to allocate the necessary economic and administrative resources re-quired for conducting one or more e-voting pilots.ii

As part of the preparation of the probable tender process for the supply of a system fornon-remote electronic voting and counting (hence referred to as an ‘e-voting system’),the Ministry of Economic Affairs and the Interior wished to explore the possibilities thatthe market has to offer at this point in time,inter aliatoget an overview of the eco-nomic implications of introducing e-voting in Denmark.The Ministry of Economic Affairs and the Interior has therefore conducted a technicaldialogue with 7 economic operators with documented experience with developmentand implementation of electronic voting and counting systems for elections to popu-larly elected organs, i.e. elections for national or local parliaments or governments etc.3.The official announcement

The dialogue was carried out in accordance with the rules of the EU ProcurementivDirective and the lines indicated by the prior information notice no. 2012/S 122-201846 of 28 June 2012.Invitation for participation requests to the technical dialogue was issued on 28 June2012 in TED, the online version of the 'Supplement to the Official Journal of the Euro-pean Union' dedicated to European public procurement, where the conditions for par-vticipation were also stated. The deadline for request by economic operators to par-ticipate in the technical dialogue was set to 3 August 2012 at 12:00 noon CEST.The rules on the right to enter into a technical dialogue with the market are found inpoint 8 of the recital in the EU directive on public procurement. The rules have beenviimplemented into Danish law by Executive Order no. 712 of 15 June 2011 (in Danish)on the procedures for the award of public works contracts, public supply contracts andpublic service contracts.4.Selection of participants and procedure for the technical dialogue

Selection criteriaParticularly out of regard for the resources allocated by the Ministry to carry out thepreliminary study, the Ministry decided that a maximum of eight economic opera-tors/partnerships would be invited to the technical dialogue. In the event that morethan eight economic operators/partnerships requested to participate in the technicaldialogue, the Ministry of Economic Affairs and the Interior would invite all economicoperators/partnerships that have documented experience with development, delivery,implementation and operation of electronic voting systems for larger organisa-tions/institutions, including in particular public institutions. If more than eight economicoperators/partnerships could document such experience, the Ministry would selectthose economic operators/partnerships that have documented experience with thedevelopment and implementation of electronic voting and counting systems for elec-tions to popularly elected organs, i.e. elections for national or local parliaments or

ProcedureFor each invited economic operator or partnership the technical dialogue consisted ofone bilateral meeting between the economic operator(s) in question and the Ministryof Economic Affairs and the Interior and its partners. The meetings each lastedapprox. 3 hours, of which approx. 45 minutes were set aside for a demonstration ofthe e-voting system of the economic operator(s) in question.The meetings took place during the period of 21 August – 3 September 2012. All ap-plicants were informed that participation in the technical dialogue is neither a precondi-tion for participation in the anticipated procurement, nor will it improve the chances ofparticipating economic operators for eventual prequalification. The economic opera-tors were informed that the Ministry as a public authority is subject to the Danish Pub-lic Records Act and thus can be obliged to give access to documents etc. to the extentfollowing from its obligations under this Act, but that any request for confidentiality re.information imparted during the oral technical dialogues would be respected by theMinistry as far as possible.5.Framework and meeting agenda

FrameworkThe economic operators were informed that a future e-voting system in Denmark willbe used only fornon-remote electronic votingin a controlled environment at pollingstations on election day and/or for advanced voting on the premises of the municipali-ties; not for voting over the internet or by other remote voting channels. The systemshould thus be employable for the following phases: preparation of the equipmentbefore the election, polling, counting and notification of the results as well as packingand storing.The system should also be adaptable to the Danish context and election legislationand traditions, i.e.inter aliabe designed to secure a high degree of recognisability forvoters and a continued high trust in elections. The Danish turn-out is among the high-est in the world for countries where voting is not mandatory (87.7 per cent at the lastgeneral election in September 2011; approx. 65 per cent at local elections). The sys-tem must therefore be designed in such a way that the high turn-out and trust in elec-tions are maintained.Digitalization of the polling implies that some of the control mechanisms meant to en-sure public control with the elections will be replaced by digitalized procedures, whichcan only be checked by specialists with particular insight in it-systems etc. Public con-

trol mechanisms in a Danish context would e.g. be the demonstration and subsequentsealing of the empty ballot boxes in front of the voters in attendance before the elec-tions commence at 9:00 a.m., and the voters’ right to watch the manual count of thevotes after the election is closed at 8:00 p.m. To ensure a continued high trust in elec-tions – hitherto obtained and preservedinter aliavia the aforementioned public controlmechanisms – the Ministry was therefore also interested in obtaining information onalternative control mechanisms, which provide the voter with a comparable high de-gree of trust that the polling has progressed correctly, i.e. without system failures orany manipulation with the elections. The system should also be trustworthy and robustand ensure that the election can continue even if the system malfunctions partly orcompletely during the polling.The system should also guarantee the secrecy of the vote, which in the Danish con-text entails that the voter not only has therightto keep his/her vote secret, but is alsounder theobligationto do so, i.e. the voter is not free to show his/her vote to others. Inaddition, it must be impossible to connect a voter and the vote he/she has cast, includ-ing indirectly by e.g. logging or electronic detection of screen displays or the like byexternal devices etc.The system should finally also be user-friendly and readily accessible to all voters,including voters with disabilities. The Ministry was therefore interested in a presenta-tion of any measures that could render the polling more accessible to voters with dis-abilities, preferably allowing them to vote without assistance.AgendaBefore each meeting, the Ministry of Economic Affairs and the Interior sent out anagenda to all participating economic operators reflecting the general framework,where it was stated that the Ministry wished to gain closer insight intointer aliathefollowing issues:1.2.Protection of the secrecy of the vote in general by the e-voting system.Protection of the secrecy of the vote in particular by the use of dedicated hardware vis-à-vis the use of non-dedicated hardware, including processes for safe destruction ofsensitive data.3. The securing by the e-voting system that the polling has passed off without incident, in-cluding by the production of a physical manifestation of the vote (VVPAT or similar) thatcan both offer sufficient proof to the voter that the polling has passed off correctly andbe included in a manual recount.4. The safeguarding by the system of correct polling and registration of the vote and thepossibility to control that the system has not failed or been manipulated along the way(security).5. The possibility to secure accessibility to the system for the disabled.6. The economic implications of introducing the e-voting system of the company/ies inquestion in Denmark, divided into the expenses for a) the purchase or leas-ing/accommodation of hardware, b) the purchase or leasing of soft ware, c) service andoperation, back-up, training, maintenance etc.7. Possibilities for further development of the system and possibilities to adjust the e-voting system for future needs and update it to exploit new technological possibilities(possibility for agile development and innovation).8. Possibility of scaling of the system, including information on the possibility to separatethe polling and counting functionalities, so that the system initially could be limited toballot marking, but later can be connected to a digital counting device if desired.9. Usability in general and for the disabled in particular10. Advantages and gains of e-voting in general and in particular from employing the e-voting solution demonstrated

The Ministry was presented with 7 solutions for digital voting and/or counting. Basedon the description given in the EU information notice of the preliminary considerationsby the Ministry and municipalities as to the framework of the upcoming e-voting pilots,the economic operators presentedsix different ballot generating systemswith theoptional possibility of adding e-counting/scanning devices andone ballot scannersolution.The economic operators offered a demonstration of some of their vot-ing/counting equipment that the economic operators estimated would be relevant in aDanish context.The e-voting and e-counting solutions demonstrated were for the most part only one ofmore options among many other different solutions and services that the economicoperators could provide. Examples of other electronic voting schemes and serviceswere briefly touched upon during the economic operators’ presentations (e.g. internetvoting remotely or via connected terminals at polling stations, central optical scanners,DRE’s with or without paper trail, election management solutions, etc.), but will not befurther discussed or described in this report.

A.Ballot generator solutionsAll ballot generator solutions demonstrated are more or less structured in the sameway:After being matched against the electoral register at the polling station, the voter ishanded a tokenwhich can either be a smartcard with a chip similar to a credit card or acardboard card with an integrated RFID-chip. The token can either be handed to thevoter, or the voter can choose any random token from e.g. a tray to enhance thevoter’s trust that his/her privacy is protected and that the token does not contain anypersonal information on the particular voter.The token can be initialized before the election (which will take time) or for reasons oftime constraint and transparency be initialized at the polling station by the electionofficial in front of the voter or ultimately by the voter him/herself. The token can bestored with particular information identifying e.g. the voting district that the voter be-longs to (which is relevant if the voter is e.g. voting in advance and needs a differentballot than the one that corresponds to the particular municipality where the advancevoting is taking place) or whether the voter is disabled and special features need to beactivated in the ballot generator, e.g. the screen should be turned off etc.The voter inserts the token into the ballot generator placed in the polling booth. Thetoken initializes the machine and activates the ballot interface. All solutions demon-strated employ a touch screen, where the voter makes his/her choices by touching thedifferent options on the screen. Most solutions offer a multiple layer solution, in whichthe voter first is presented with a frame enlisting the different parties and the option tocast a blank vote. If the voter wishes to cast a preferential (personal) vote for a par-ticular candidate, the voter has to choose the party that the candidate belongs to inorder to be presented with a new frame showing the different candidates that arestanding for the party in question. The interfaces shown varied a great deal in designand usability, but all economic operators assured that the interface could be custom-ized to fit the customer’s wishes.The voter then has to confirm his/her choice and a ballot is printed by the machine.Systems employing smartcards will print a separate ballot on paper (different qualitiesand thicknesses were demonstrated, but can almost always be customized), wherethe vote is printed in both a human readable format (fonts etc. can be customized) anda 2D bar code thatenables electronic counting and tallying. The bar codes displayedon the ballot papers are encrypted and cannot be read with mobile phone QR-scanners or similar. Systems employing a card board card with RFID will print the vote

in a human readable format on the same card used to initialize the ballot generatorand store the encrypted electronic readable reproduction of the vote in the RFID (othersolutions are also being considered).All solutions that include storage of the vote on a 2D bar code offer some kind of veri-fiability functionality, so the voter can choose to scan the bar code and verify that itcorresponds to the human readable text imprinted on the ballot paper. The verifiabilityscanner can either be integrated in the ballot generator so the voter can immediatelycheck the bar code in the same voting booth after the ballot is printed, or be placed ina separate location, e.g. a secluded booth.Solutions that employ a smartcard entail that the smartcard has to be deposited by thevoter after the voting is completed; different solutions for this were demonstrated.The voter then proceeds to the ballot box and scans the ballot him/herself and depos-its it in the ballot box. Some solutions entail that the voter has to scan the ballot andthen insert it manually in the ballot box, while others offer transactional operation,meaning that the ballot is placed manually in a slit or similar in the ballot box and thentrapped and deposited mechanically into the ballot box. According to the economicoperators, either solution will require a trade-off between the benefits the differentchoices offer and some of the disadvantages they result in in return.When the polling is closed at 8:00 p.m, the votes can either be counted manuallyand/or electronically, where after the system procedures a report of the electroniccount and tally. The electronic counting solutions can produce reports on both thenumber of party cotes and personal votes etc. The results can be transmitted to thecentral tabulation computer either by a secure wireless internet system, modem or 3Gor by a USB-stick protected by passwords and encryption, etc. and then collected andinserted into the central computer and tallied there.Common to all solutions demonstrated is that the ballot is not stored in the ballot gen-erator, but only on the printed ballot, until it is introduced in the ballot box, where it canbe scanned and stored electronically or simply inserted for manual count without anyelectronic recording of the ballot. Other options briefly discussed besides printing ofindividual ballots include real-to-real and cut-&-drop paper recording of the vote.

B.Optical ballot scanning and e-counting solutionsOne vendor demonstrated an alternative approach, in that this vendor unlike the othersix does not supply a ballot generator, but an optical scanner that can scan paperballots marked by hand by the voter.After being checked in the electoral register, the voter is handed a paper ballot similarto the one currently used. The design of the ballot can be customized according to thecustomer’s wishes. The voter marks the ballot with a pen, ticking off or filling in a boxor circle beside the party or candidate of his/her choice.The voter then proceeds to the ballot box, which is mounted with a scanning device,atabulator and a screen. The voter inserts the ballot in the scanner, which will read theballot and show the result on a screen so the voter can verify his/her selections. Themachine can via the screen alert the voter if he/she has invalidated the vote by filling itout incorrectly or not filling it out at all (a blank vote). The voter can then decidewhether to cast the vote or retract it if it has been filled out incorrectly and the voterwants to exchange the ballot. The ballot is transitioned mechanically into the ballotbox. The solution includes measures for protection the secrecy of the vote (e.g. a cardboard folder).

Apart from the demonstrations of their e-voting and e-counting solutions, the economicoperators provided answers to the Ministry’s questions related to the different topicslisted on the agenda, cf. section 5 above. Among these were:7.1. Protection of privacy and the secrecy of the voteAll economic operators have been required to identify the greatest risks to privacy andthe secrecy of the vote and to demonstrate how their solution mitigates the risks iden-tified, as well as to share their experience on what technical and procedural safe-guards it would be recommendable to implement.Most solutions do not entail any connection between the identity of the voter and theballot, as they are based on the hand out of a randomly chosen token to the voter forinitialisation of the ballot generator and do not store the vote on the ballot generator, orare based on the hand out of a paper ballot like today. Some of the systems haveoriginally been developed for the internet and do require an initial storage of both theauthentication data and the vote, but these systems nevertheless have technical solu-tions in place to protect privacy and the secrecy of the vote (separation of databasesviifor authentication and storage of votes and ‘double envelope’ systems).All economic operators have considered the secrecy of the vote in the handling of theballot.The electronically generated ballots can be folded to hide the human readable depic-tion of the vote and only expose the 2D bar code, which is not readable by the humaneye. In addition, the bar codes are encrypted so that the bar code cannot be read by ascanner in a mobile phone or other device except for the system scanners containingthe algorithm to decrypt the bar code, and no two bar codes are alike irrespective ofthe choice they represent. The economic operators are also all aware that the ballotshould be the same length regardless of the choice it contains to retain the secrecy ofthe vote.Most economic operators prefer smartcards to RFID-cards stating security reasons,claiming that cards with RFID-chips could be read or jammed from a distance byhardware that is relatively cheap and easy to buy from the internet. Additionally,smartcards can be reused many times; it is also not necessary to procure a smartcardfor every voter, as they can be reinitialized after being used by a voter.Economic operators favouring RFID have countered that the use of RFID allows thetoken to be used both to initiate the machine and to store the vote, thus reducing thecomplexity of the voting procedure for the voters. Additionally, the RFID-chip can ac-cording to the economic operators be protected against eavesdropping or jamming byputting the right procedural safeguards in place. Finally, the economic operators offer-ing a RFID-solution contested that RFID-cards are more expensive to procure thansmartcards, although it was not disputed that an RFID-solution will entail the need tobuy one card for every voter and that theyipso factocannot be reused.Most solutions shuffle the votes before decryption to ensure that they are recorded ina random and different order than they were cast, so no one can restore a connectionbetween the voter and the votes on the basis of electronic or manual time-logging orsimilar.Regarding optical ballot scan systems that scan a regular hand-filled ballot, the ballothas to be inserted into the scanner in its full length, i.e. it cannot be folded to protectthe secrecy of the vote. However, as mentioned in the description of the systemabove, a card board folder can be provided to hide the text of the ballot, which canalso be inserted with the text down or in a secluded environment.

7.2. Dedicated versus non-dedicated hardwareMost economic operators employ dedicated hardware in their solution, although incombination with commodity hardware for e.g. optical scanners, touch screens etc.The hardware encased in the ballot generator machines is mostly industrial standardcomponents. The dedicated ballot generator machines have an average life span of15-20 years according to the economic operators . The main argument of these eco-nomic operators for employing dedicated hardware issecurity,claiming that dedi-cated hardware offers better security against visual and electronic eavesdropping, andbetter logical protection. Also simplified installation, deployment and maintenance arecited by the economic operators as some of the important benefits of dedicated hard-ware as opposed to a solution based solely on standard off-the-shelf components.A couple of the solutions demonstrated to the Ministry were based solely on commod-ity ‘off-the-shelf’ hardware; one of the economic operators providing such solutionsargued that the trend in their opinion is moving away from procurement of expensivededicated hardware with what it entails of warehousing, maintenance, and obsoles-cence issues to software and services. Economic operators that base their solutionson commodity hardware offer to install their software in a wide variety of hardwarecomponents, and claim that it is possible to reduce costs further by leasing the hard-ware, arguing that the commodity hardware can be securely wiped after elections andreused for other purposes.The economic operators have summed up the advantages and disadvantages ofdedicated hardware versus non-dedicated hardware as follows during the dialogue:Dedicated hardwareEasier to restrict access toparts and internal hardwareEasier installation and tech-nical assistanceEasier to use for voter andelection officialsNo need for software portabil-ity (software only needs to bedeveloped and tested for onetype of hardware)Replacement of componentsEnsure privacyLess costlyPossibility to reuse HW forother purposesHW independenceCommodity hardware

cording of the vote (by adding a 2D bar code or OCR imprint of the vote). The opticalballot scanning solution presented by one of the economic operators also involves apaper ballot, as it relies on a traditional hand filled ballot.7.4. Security and safeguardingThe question of ensuring security against malfunction and internal as well as externalattacks was one of the primary focus points of the discussions during the technicaldialogue. All economic operators have a great range of different technological andprocedural safeguards in place to mitigate these risks.Among the safeguards mentioned were the following, which do not necessarily applyto all solutions, but are useful to keep in mind when considering the requirements for afuture Danish e-voting solution:

Stronglayer-upon-layer cryptographyapplied to ballots, software, etc.Production ofzero talliesbefore the polling commences to prove that the bal-lot box is empty – the zero tally can be designed in such a way that it willautomatically erase anything in the memory component if something shouldaccidentally or deliberately be stored there,Possibility to employtime lockstoensure that the system can only be acti-vated at a fixed time, e.g. during the poll,Systemintegrity, availabilityand authenticity tests,Ballots are not stored electronically on the ballot generators,Ballots aredecrypted by a quorumafter the polls are closed, and the de-cryption keys are created only by the quorum after the election,Systems (e.g. holograms etc.)prevent ballots from being copied, submit-ted, and/or counted multiple times,Security againstelectromagnetic eavesdropping,Tampering and malfunction alarms,which either go off with a loud sound inthe voting booth or are communicated more discreetly to the polling supervi-sor via a headset,Entrances in ballot generators are securedwith physical keys andstrips/seals,Mathematical proofsof decryption and counting are run after the elections tomake sure that the ballots have not been tampered with and that the systemhas functioned correctly,Hardware is standaloneduringpolling hours,Ballots are shuffledbefore they are decrypted to protect privacy and secrecyof the vote,Storage ofimages of every ballot,

Despite all these and more security provisions, some of the economic operators con-tended that a significant number of threats can and should rather be mitigated by en-suring that the right protocols and procedures are in place. Security should be lookedat as involving a combination of people, process and product that all have to worktogether.Audit and certificationMost economic operators presented a wide range of certificates and credentialsixachieved from their work with election systems for other customers around the globe.Many of the systems provided by the economic operators that participated in the tech-nical dialogue have been audited by ‘the big four’ auditing economic operators (PwC,Ernst & Young, Deloitte and KPMG) as well as by academics employed by the cus-tomers etc. The economic operators are thus accustomed to having to comply withdifferent standards and undergo different certification and audit procedures and pre-pared to do so also in a Danish context.Open sourceAssessment that an e-voting systemfunctions correctly and that security ismaintainedis very essential to validate the results of an election and retain the publics’ trust in thexelectoral process. This assessment can be done by the independent evaluation or asmentioned above certificationof the system as a whole or of its components, whichrequires disclosureof the critical system elements. The assessment can be carried outthrough,for example, disclosure of the system design, inspection of detailed documen-tation,source code disclosure, inspection of component evaluation and certificationre-ports, in-depth penetration testing, etc. The actual level of disclosure ofthe systemelements needed to achieve appropriate assurance depends on thespecific features ofthe system, its components and the services provided. In this context, one of thequestions that need to be addressed is whether the system provided should be “openxisource”.All economic operators declared themselves ready to hand over the system softwarefor independent review, while retaining property of the solution. Many of the solutionsuse Linux based operating systems. Some economic operators sell the software to thecustomer to do with it as the customer seems fit, including having other economicoperators or in-house capacities develop the software, others provide the software ona license basis.7.5. Accessibility for the disabledAll solutions demonstrated to the Ministry during the technical dialogue have differentaccessibility features that allow one or more specific groups of disabled voters to votewithout forfeiting the anonymity of their vote, i.e. by enabling them to vote without as-sistance by a third party, e.g. a family member or election official.The solutions haveall been developed and tested in cooperation with different local associations for thedisabled and live up to different national and international standards.

All solutions include a feature for blind and visually impaired that incorporates somekind of audio ‘read aloud’ functionality. The Ministry discussed with the economic op-erators ways to ensure that a blind or visually impaired voter would know which way tofold the ballot to fold it correctly, so the human readable text is not shown to anyoneelse before or during the insertion of the ballot into the ballot urn.Other functionalities presented allow for the use of sip-and-puff devices, joy sticks,buttons, pedals, head-and-mouth pointers, enlarged fonts on screens, and key boards.The solutions that employ smartcards to initiate the ballot generator machine all havethe possibility to have information added to the smartcard indicating that the voter isblind/visually impaired or otherwise disabled, thus instructing the ballot generator toeither turn off the screen or allow the use of a special feature.All economic operators of ballot generators emphasized that the different disabilityfunctionalities as default are added toallballot generator machines, so voters needingthese functionalities can choose any voting booth containing the machine instead ofbeing assigned to a particular voting booth, with the exception of the optical scannersolution.A common fact for all systems for the disabled to take into account according to theeconomic operators is that voting for the disabled using any of the described function-alities will invariably take longer compared to a non-disabled voter.7.6. Economic implicationsPreconditionsAs previously mentioned, the economic operators have demonstrated several technic-al solutions essentially spanning from optical scanning and e-counting of hand-filledpaper ballotsto ballot generating systems with optional e-counting functionalities. Thedifferent systems demonstrated during the technical dialogue are built up from differ-ent technical solutions of varying complexity and with different choices of components(dedicated/non-dedicated hardware etc.), which is reflected in the tentative pricingquoted by the economic operators.The tentative level of expenditure stated below has been calculated on the basis of anisolated e-voting pilot and therefore also encompasses non-recurrent expenses forprocurement of ballot generators and/or e-counting equipment etc. The equipment canbe reused as a starting point if the evaluation of the pilot is positive and permission isgiven for more pilots or e-voting is permitted on a more general basis. The hardwarehas an estimated life span of at least 7-9 elections. Furthermore, the Ministry esti-mates that expenses for training, project management and voter information (see thelisting of expenses below) will be relatively high for the first pilots and then graduallydecrease.The calculations have been made on the basis of a turn-out of 88 %, which is ratherhigh and corresponds to the turn-out at parliamentary elections. If the calculation isbased on a lower turn-out, e.g. corresponding to the usual turn-out at local or Euro-pean Parliament elections, the number of hardware units required for e-voting and/ore-counting will probably be somewhat lower.An average of the prices indicated by the economic operators for comparable equip-ment has been employed for the calculation of the followingtentative, overall costestimates.It has furthermore been presupposed re. the prices for ballot generatingsystems that all voters in attendance at the polling station will cast an electronic voteand that “intelligent” ballot boxes are employed for the recording, counting, and tallyingof the electronically generated ballots.

Expenses for technical support, training, project management and implementation,voter information, control and audit, and evaluation are estimated.A. Polling station with 2,500 votersThe total expenses including the elements listed above will, depending on the chosensolution and the technological setup etc., roughly estimated amount to250,000 –450,000 DKKfor an e-voting pilot on a polling station with 2,500 voters.B. Polling station with 5,000 votersThe total expenses including the elements listed above will, depending on the chosensolution and the technological setup etc., roughly estimated amount to350,000 –750,000 DKKfor an e-voting pilot on a polling station with 5,000 voters.C. Polling station with 10,000 votersThe total expenses including the elements listed above will, depending on the chosensolution and the technological setup etc., roughly estimated amount to550,000 – 1.1mill. DKKfor an e-voting pilot on a polling station with 10,000 voters.Potential reductions in expenditureThe number of election officials needed at the polling station is estimated to be un-changed on election day and during the counting and recounting during the first e-voting pilot.In the event that a number of elections is subsequently carried out employing opticalballot scanners or ballot generators combined with an e-counting functionality, theelectronic counting and tallying might in time partly or completely replace the manualcount of the ballots at polling stations and eventually also the recount, resulting inreductions of administrative expenditure.7.7. Innovation, agile methodology and possibilities for further development(transferability)All economic operators stated that their systems are continuously being updated anddeveloped and that they employ an agile methodology, including new technological

possibilities as they arise. New versions always leverage market improvements, andthere is independent evolution of each component. Some of the economic operatorsshared some future plans for development of their systems.Training and servicesAll economic operators offer training and services as part of their solution. Trainingcan be designed to meet the customer’s need. Many economic operators provide e-learning tools as a supplement to on-site training. Most economic operators employ atrain-the-trainer methodology, as itinter aliais viewed as most cost-effective. Someinternational economic operators usually choose to work with a local partner to providesupport and other services. All manuals can as a rule be provided in the customer’slocal language (i.e. in Danish), and calling centres will be staffed with native speakers.7.8. Scalability and separation of functionalitiesAll economic operators informed the Ministry that their solutions could easily be scaledand cited a number of past experiences where it had been necessary to upscale thesolution rapidly. The solutions are all built according to a modular approach, whichmeans as previously mentioned that the solutions can be customised in a number ofways to meet the demands of the customer.The ballot generator-solutions can be progressively introduced, so that initially themachine only marks the ballot, and the e-counting functionality is added at a laterstage when voters have grown comfortable with e-voting. However, one economicoperator argued that the ballot counting functionality is the least costly when it comesto an ballot generator-solution and concurrently one of the most beneficial. The eco-nomic operator therefore recommended that the Ministry and municipalities opt for thefull end2end solution from the beginning. The voter verification station could also beadded at a later stage, but one economic operator argued that this functionality is im-portant to implement in the beginning, where voters most likely will be more scepticaland eager to verify the bar code on their ballot to make sure that the machine hasworked as intended.ImplementationMost economic operators stated a lead time of between 6-18 months from contractsigning to election day. This period will however depend on the scale of the procure-ment; if the solution is being procured only for a limited pilot of 10-30 polling stations,the implementation time of the system will naturally be shorter than if the solution isbeing procured for the whole country. Stages to be considered when drawing up theproject plan include blue print stage (for definition of inter alia the requirements), voterengagement and information campaign (should be initiated as soon as possible and ingood time before the election), adaptation of solution to Danish legislation and stan-dards and approving of design, independent review/certification of HW, SW, and pro-cedures, manufacture of machines, tests and mock election(s), sealing, training ofelection staff and finally roll-out of solution, delivery tests etc. However, all economicoperators that the Ministry has met with have vast experience in adapting and custom-ising their solutions to meet the specific needs of the customer, and can also offersome flexibility re. implementation.8.Advantages and risks/disadvantages of electronic voting and counting

A. More accurate tallyingElectronic counting can offer more accurate tallying and as good as eliminate hu-man errors in the counting process.Some of the economic operators recommended that when manual counts are tobe conducted for audit purposes after the electronic tallying (either as a completerecount or random checks), a proper procedure should be implemented to mini-mize human error. E.g. counts should be undertaken by independent auditors orofficials that have not been participating in the election all day, where the risk ofthem not being capable of conducting a recount under optimal conditions is sig-nificantly enhanced compared to if you bring in a “fresh” team. Also, the recountshould be undertaken in teams of 2 or 3, where all individuals must agree on theresult before it is compared with the electronic tally.B. Voter verifiabilityAll the demonstrated electronic counting systems offer the voter the possibility toscan his/her ballot before inserting it in the ballot box either manually or by transi-tional operation. Hence, the voter is enabled to verify him/herself that the vote isactually counted, which is not possible in the traditional paper based and manuallycounted elections.C. Provides the disabled with the opportunity to vote without assistanceAll the systems demonstrated during the technical dialogue include features thatare designed to enable voters with disabilities to cast their vote without assistance.The range of disabilities covered by the different solutions and their usability vary,but all do to some extent make it possible for some groups of disabled voters tocast their vote unsupervised (cf. section 7.5. below).D. Eliminates involuntarily spoiled ballots while keeping the option to casta blank voteAll the demonstrated solutions can prevent the casting of involuntarily spoiledvotes, while still retaining the option to cast a blank vote, as the voter only has theoption to mark the ballot electronically with one choice (either a vote for a particu-xiilar candidate, a particular party or a blank vote.E. Additional ‘back-up’ storage of ballotsAccording to the economic operators, the e-voting solutions contain an extra secu-rity provided by the electronic storage of the ballots and results in parallel with thephysical storage of the paper ballots. This offers redundancy, as the result of thepoll can be reproduced if for some reason the paper ballots should be damaged,destroyed or lost, thus avoiding a second ballot as the ultimate consequence if asignificant number of ballots cannot be produced for the count or recount for oneof the reasons previously mentioned.F. Faster count and results & reduction of administrative resources formanual countE-countingipso factoenables a much faster tally and result. The economic opera-tors informed the Ministry that a faster and more accurate count and tally also of-fers significant advantages from the administrative point of view of the municipali-ties, in that it can lead to a reduction of resources allocated to the manual countand particularly to the recount (which could on the long run become redundant).However, this advantage would only manifest itself over time, and should beweighed against the increased economic implications of procuring and maintain-ing e-voting equipment and the additional staff that will be required to set up, runand pack the equipment after the election.

On basis of the information received by the economic operators on the different poten-tial benefits of e-voting, the Ministry finds that the municipal councils which are con-sidering to engage in e-voting pilots should have a thorough discussion of the enlistedand other possible potential benefits of e-voting and e-counting, and ultimately decidewhich of these should be guiding for the municipalities’ overall strategy for conductinge-voting and/or e-counting pilots.Risks and disadvantagesThe greatest risks or disadvantages of introducing and employing e-voting and/or (to alesser extent) electronic counting is in the opinion of the consulted economic operatorsnot so much a question of technology flaws or security issues, but more ofperceptionandtrust.For this reason, some economic operators recommend introducing e-voting by a step-by-step approach, starting out slowly and giving the voters sufficient time to familiarisethemselves with the changes and get to trust the system by seeing it work in a satis-factory way in numerous elections. Some economic operators also pointed out that intheir experience voters are generally receptive and positive towards the introduction oftechnology in the election realm, while scepticism is often mainly expressed by candi-dates and political parties. Therefore, it is important to conduct independent auditsafter the elections that can prove beyond any reasonable doubt that the election hasnot been tampered with and that the results have been correctly counted and tallied.Notwithstanding, the economic operators also pointed out that the issues ofsecurityagainst malfunction and manipulationof an e-voting system as well as the matter ofpreserving the voter’s privacy and the secrecy of the ballot are equally very importantissues to consider and protect when drawing up the requirement specifications for afuture e-voting/e-counting solution and during the procurement process.9.Conclusion: Choices have to be made

Most economic operators can provide customized solutions and employ a modularmethodology. The economic operators all operate in several different countries with alarge variety of election systems, where the lesson learned and imparted to the Minis-try during the technical dialogue is that no two election systems are the same, some-times not even within the same country (e.g. USA).Therefore, if Denmark proceeds with the plans to make its own experiences with e-voting, a number ofchoiceswill have to be made,inter alia:What are the main benefits that the municipalities expect to obtain from an e-voting system, and which kind of solution does best fit these needs taking into ac-count the economical aspects?Should e-voting in Denmark be introduced in the form of a ballot generator thatmarks a ballot paper electronically, or should we opt for an optical ballot scanningand counting device that scans and counts hand-filled ballots?If the first option of an electronic voting machine that marks the vote electronicallyis chosen, should the votes then be recorded on the e-voting machine, or shouldthey only be recorded when a paper ballot or similar is introduced into a scanningdevice?Should the solution be based on dedicated hardware or commodity hardware?Should the voters be offered the opportunity to verify not only the human readableimprint of the vote, but also any electronic record (bar code or similar)?What kind of accessibility functionalities should be offered to disabled voters?

KL is the interest group and member authority of Danish municipalities.http://evalg.teknoprojekt.dk/iiihttp://www.demtech.dk/#ivhttp://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:134:0114:0240:EN:PDFvhttp://ted.europa.eu/udl?uri=TED:NOTICE:201846-2012:TEXT:EN:HTMLvihttps://www.retsinformation.dk/Forms/R0710.aspx?id=137281viiThe electronic ’double envelope’ systems are similar to the system employed for advance voting today, where theadvance ballot until election day is stored in an envelope that is sealed and placed in a new envelope with a coveringletter containing inter alia the name and address of the voter. The covering letter and sealed envelope containing theadvance vote are separated the day before election day, when the polling supervisors examine the advance votesand decide whether all formalities have been met and the vote qualifies for consideration.viiiA voter-verified paper audit trail (VVPAT) or verified paper record (VPR) is a method of providing feedbackto voters using an electronic voting system, as itallows voters the possibility to verify that their votes are castas intended and can serve as an additional barrier to changing or destroying votes. A paper VVPAT is bydefinition readable by the human eye, and offers the voters the opportunity to directly interpret their vote.The VVPAT may be added a bar code or other electronic readable feature for rapid electronic recording ofthe votes by scanners etc., and will make it more difficult for voting machines to corrupt records withouthuman intervention.ixAccording to the Council of Europe’s Recommendations on legal, operational and technical standards fore-voting (2004) (standards 111-112), an e-voting system should be subjected to a certification processintroduced by the public authority responsible for procuring or defining the necessary requirements of an e-voting system. The certification process should allow for any ICT (Information and Communication Technol-ogy) component in the chosen e-voting solution to be tested and certified as being in conformity with thetechnical requirements set up by the same authorities. In addition, end-to-end auditing including recording,providing monitoring facilities and providing verification facilities should also be undertaken (standards no.100-110). See Recommendation Rec(20045)11 of the Council of Europe on legal, operation and technicalstandards for e-voting. Available at: http://www.coe.int/t/dgap/democracy/activities/GGIS/E-voting/Key_Documents/Rec(2004)11_Eng_Evoting_and_Expl_Memo_en.pdfxAccording to the Council of Europe’s “Legal, operation and technical standards for e-voting”, standard no.24, the components of an e-voting system should always be disclosed, at least to the competent electoralauthorities, for verification and certification purposes.xiOpen source is a philosophy, or pragmatic methodology in production and development that promotes freeredistribution and access to an end product's design and implementation details, typically employed forsoftware solutions. There is an international discussion whether such a critical system that touches upon thecore of democracy should be validated according to the methodology of open source, the argument for thisbeing that open source entails greater transparency, perceived as the hallmark of democratic elections.xiiIn the experience of the Ministry, the large majority of the spoiled votes have not been purposefullyspoiled by the voters; the majority of the voters having cast a spoiled vote other than a blank vote are thusunder the wrong impression that their vote has been correctly cast and counted and forms part of the overallresult.ii