The 2018 municipal elections in Ontario that used online voting had some fairly obvious hiccups. Owen Sound, like many other municipalities, had to extend voting and the results were more than 24 hours late. Although local residents expressed a slight preference for paper ballots in a 2016 service review survey, Council chose the new system because it was somewhat cheaper and pitches from the vendor suggested online voting would increase voter turnout. Participation was actually more than 8% lower in the 2018 municipal election (43.9%) than in 2014 (52%).
Local residents sent many concerns to us at the Owen Sound Hub before the election about the errors and omissions in the voters' list, and more specifically about the vendor and the security of the technology.
Recent research out of the University of Western Onntario and the University of Melbourne titled Online Voting in Ontario Municipal Elections:
A Conflict of Legal Principles and Technology? provides a comprehensive analysis of the gaps in cybersecurity in the 2018 election. The executive summary of the 2020 report by Anthony Cardillo, Nicholas Akinyokun, and Aleksander Essex of Whisper Lab, "dedicated to the voters and candidates of future Ontario municipal elections", is reproduced below. The full report is available at https://whisperlab.org/ontario-online.pdf.
"Despite Ontario having one of the largest concentrations of online voters globally, its use is not governed by any federal or provincial cybersecurity standard. This has left many municipalities to make decisions largely in isolation, relying on private for‐profit vendors to set their own bar
for cybersecurity and public accountability.
This report presents the first comprehensive study of the cybersecurity of online voting in the context of Ontario’s 2018 municipal election. Our key findings include:
• The only comprehensive accounting of online voting adoption, vendor partnerships, and the extent of municipalities affected by emergency extensions to the voting period on election night,
• Identification and discussion of cybersecurity incidents and non‐best practices observed in the election, including weak voter authentication, poor transparency and account‐ ability of election results, and a general lack of disaster‐preparedness, which resulted in nearly one million voters receiving an emergency extension to the voting period due to a misconfiguration in the online infrastructure on election night,
• A study of ballot secrecy demonstrating that up to 50% of the online voters in the 2018 election were uniquely re‐identifiable by their login credentials,
From these observations, we question whether the democratic and legal principles of the Municipal Elections Act are being adequately protected by the technology deployed in practice and provide a series of concrete recommendations for municipalities and the province, including the development of mandatory minimum cybersecurity standards of online voting."
