How remote electronic voting is arranged in Russia, and what prospects it has

"(a photo - ikhmao.ru)"

Remote voting: voter experience

Any citizen of the Russian Federation with an active suffrage, registered at the place of residence in one of the seven subjects for whom such a voting option was organized, could take part in remote electronic voting: Kursk, Murmansk, Nizhny Novgorod, Rostov and Yaroslavl regions, as well as Moscow and Sevastopol.

According to the chairman of the DEG territorial election commission, Ilya Massukh, 587 thousand 249 people took part in online voting in the regions, the turnout was 92.4%. This is the usual turnout for electronic voting, said Massukh^[1]. In total, in six regions where the remote voting option was available, about 8.52 million voters were registered^[2].

And in Moscow, more than 1.94 million voters took part in the electronic voting with a turnout of 96.5%^[3]. In total, there are about 7.44 million voters in Moscow. All DEG participants had to be registered on a single portal of public services with a confirmed account. Participation in electronic voting was voluntary. To take advantage of this opportunity, it was necessary to submit an application on a single portal of public services, and in the case of Moscow, also on the portal mos.ru in the user's personal account. Applications were received from August 2 to September 13 inclusive.

At the same time, the voter was given the right to withdraw the application no later than 24:00 Moscow time on September 13. Once the DEG member lists have been created, the decision cannot be changed. When the voter was registered in the DEG system, his name was removed from the list at the polling station, and he could no longer vote using a paper ballot.

Federal Platform

The federal platform for online voting - CAS DEG - was developed by Rostelecom. A detailed description of it is available at the link.

In 2020, the CEC reported that Rostelecom was developing a system on its instructions. The CEC explained to TAdviser that since 2019, Rostelecom, in accordance with the presidential order, has been determined by the government as the sole executor of the work ordered by the CEC to digitalize the electoral process, provide digital services for participants in the electoral process and create a digital platform for the implementation of basic guarantees of electoral rights and the right to participate in the referendum of citizens of the Russian Federation.

The CEC says that in December 2019, Rostelecom signed a contract for research work in the field of search, justification and testing of organizational and technical solutions for remote electronic voting, in February 2021 - a contract for the creation of a software and technical complex for remote electronic voting (CAS DEG), including technical operation and maintenance during training and public testing, as well as in the September 17-19 elections.

Financing of the works under the above contracts is carried out within the budgetary allocations allocated by the CEC of Russia for the implementation of the results of the federal project "Digital State Administration" of the national program "Digital Economy of the Russian Federation" to provide digital services for participants in the electoral process.

The CEC did not disclose the total amounts of contracts with Rostelecom, and this information is not available on the public procurement portal. In the CEC procurement plan for 2019-2021, however, it is indicated that in total for the digitalization of the electoral process, the national program "Digital Economy of the Russian Federation" initially provided for financing about 433.6 million rubles, of which about 110 million rubles - for the development and testing of a complex of organizational and technical solutions.

The infrastructure of the federal DEG system in the September 2021 elections included 4 data centers: Rostelecom sites and two additional data centers. The system is built with the ability to scale: the first three data centers were deployed for the voting period, and the 4th data center remained under the jurisdiction of the CEC and was preserved after the voting. At the same time, the CEC still has all the voting data.

The infrastructure also includes Rostelecom backbone communication networks, IT equipment in which, in the general case, several layers are distinguished: data networks,,,, and storages virtualizations containerization. information security operating systems Then begins the field of application. ON

Rostelecom says that a significant part of the DEG infrastructure is built on equipment that is in the register of domestic products. Compared to the DEG pilot project, which was implemented in 2020, the share of such equipment and software has increased significantly, according to the company. It includes information security, network hardware, and computing and storage.

In May 2021, an all-Russian training session on the use of DEG was held (on the eve of a single voting day on September 19). Its main goal was to load test the DEG - checking the system for strength, as well as safety, convenience and functionality. 2.5 million applications were submitted for participation in the training, 1.2 million voters voted, the DEG system processed more than 5 million transactions. After assembling the keys, the voting results were summed up in less than 15 minutes. The system developer states that the time of voting the failures were not recorded, in peak loads the system worked steadily.

And then, following the results of the all-Russian training, at a meeting of the CEC of Russia on May 25, 2021, seven regions were identified where the DEG system will be applied on a single voting day on September 19, 2021.

Federal Platform Security: Some Issues

Rostelecom and the CEC assure that the system is reliably protected from, cyber attacks reliable and secrecy of voting. The federal DEG system uses a domestic blockchain platform Waves Enterprise using Russian cryptographic algorithms and protective equipment. Blockchain allows you to keep encrypted the votes of voters unchanged.

Information is encrypted using a special key loaded into the blockchain during a special procedure, which takes place in the TEK DEG before voting begins. To decrypt, you need another special key, which is created and divided into several parts during the same procedure, but is collected only when summarizing. Parts of the decryption key are recorded on secure media and transferred for storage to independent "holders" until the end of the vote. One of the key parts is also stored in the module information security (Hardware Security Module, HSM) and is not extracted from there. The cryptographic algorithm allows you to carry out mathematical operations with encrypted data, therefore, to summarize the results, the total encrypted bulletin is decrypted. Voters' ballots themselves are not decrypted either during or after the establishment of the results.

An inquisitive and at least a little technically savvy voter will be able to check that his vote is in the blockchain, and that the total amount of votes received on these data is also. To do this, the developers provided a number of technical tools for monitoring voting. At the same time, the voter will not be able to decipher a specific ballot and see who he is cast for.

This is a kind of compromise between giving the voter the opportunity to verify that his vote is taken into account and the fear that this will be used locally to confirm a vote under pressure or sell votes.

The system codes are partially open. So, as part of the disclosure of technical information about the DEG system, in September 2021, the source codes of the main components of the system were posted on the GitHub resource, which will be used by voting in 2021^[4]. In particular, the codes of the voting portal and the anonymous area of ​ ​ the DEG portal are available; Key splitting utilities smart contract, etc.

The CEC told TAdviser that confidence in the CAS DEG and its algorithms for processing information about the results of the will of voting participants is ensured by the following main measures:

• disclosure of information on the remote electronic voting protocol implemented by CAS DEG, cryptographic algorithms used in it and their parameters;
• control of voting participant over software running on his device, as well as disclosure of his source code (samples of source code) and interfaces of his interaction with CAS DEG;
• control of the electoral commission of remote electronic voting over technical means and software running on them for generation, division and assembly of encryption keys, control over carriers of encryption key parts;
• providing to an unlimited circle of persons during voting, during and after summing up the voting results, information about the encrypted results of the vote participants' will received in the CAS DEG, as well as software with source codes to check the completeness, integrity and continuity of the results of the will and correctness of the vote count.

At the same time, the CEC portal says that the disclosure of the full volume of the source texts of CAS DEG software in 2021 is not planned. Before fixing the initial state of CAS DEG software, it is possible to publish only examples of the implementation of key software components, software libraries, etc., writes CEC^[5].

One point that raises questions is that theoretically, another person can vote for a voter in the DEG if he has access to the user's login and password from the personal voting office at the State Services. The system makes it possible to vote from those accounts to which the mobile number is tied, issued not on the voting voter, but on other persons. And the attacker can, for example, change the mobile phone number to receive a SMS code that is used to confirm the identity of the voter.

Yuri Satirov, chief architect of the Rostelecom DEG platform, claims that recently a lot of additional measures have been taken to improve the security of accounts on the public services portal. And much depends directly on the user.

I recommend that you always include two-factor identification, and if you speak more simply, then every time you enter the public services portal, you will receive a text message with a one-time code. Only with the entry of code from SMS will the portal provide the opportunity to enter, "says Satirov. - In addition, include mandatory login notifications on the public services portal, and you will receive these notifications by e-mail.

And the CEC considers the assumption that someone can change the phone number to receive a SMS code, which is used to confirm the identity of the voter, incorrect. Making such changes requires possessing a mobile phone previously indicated in the account, or making such changes is confirmed in a way similar to confirming the account, the CEC says.

Secrecy of voting

Doubt that the DEG ensures anonymity of voting was expressed in the Pirate Party of Russia. So, Alexander Isavnin, a member of this party, a teacher at the Free University, noted that in the CAS DEG, developed by Rostelecom, homomorphic encryption is used, in fact, the choice of voters is summed up without deciphering specific votes. Rostelecom has votes cast in sequence. The company knows in what sequence the votes of specific users have been preserved, and by applying homomorphic summation not to all votes, but by throwing one out of the blockchain and summing up the remainder, it is possible to understand what choice was made by a specific user, Isavnin believes^[6].

The CEC told TAdviser that they do not share the allegations of a problem in this case.

At the same time, it should be noted that the CAS DEG and the corresponding procedure for remote electronic voting ensure the secrecy of voting in understanding the legislation on elections, and not its anonymity, the CEC added.

And the statements and assumptions that Rostelecom has votes cast in the sequence, and there is an opportunity to understand what choice was made by a specific user, the CEC considers incorrect. Implementation of the given assumptions is theoretically possible in the case of:

• Obtaining redundant identifying information from the voting participant's devices - however, in the DEG system, the device and the information transmitted from it is under the control of the voting participant himself; In addition, the voting participant at an arbitrary step of the DEG procedure can use additional means of anonymization, including proxy services, virtual private networks, etc.;
• Possession and free use of decryption keys by certain interested parties - but in the DEG system, decryption keys, the carriers of their parts and the technical means of their formation, division and assembly are under the control of the election commission of remote electronic voting and persons identified by it, and the keys of the DEG CAS units dependent on them are in an unattractive form in encryption hardware ;
• Creation of a different system instead of CAS DEG, the task of which would be to control the will of the voting participants - recording and processing of redundant identifying information about the voting participants, arbitrary counting and decryption of intermediate voting results or individual ballots. However, it would not be possible for such a system to implement confidence-building measures already implemented.

Also, as confidence measures to the CAS DEG, access to one of the nodes of the system was provided to the technical monitoring group of the Public Chamber of the Russian Federation, which allows it to control the process of receiving and recording encrypted results of the will, summing up and deciphering the voting results in the entire CAS DEG. At the same time, certification and control tests were carried out in relation to CAS DEG, providing for verification of compliance with the set of working documentation and sending reporting documentation based on the results of tests to authorized state bodies.

Oleg Artamonov, deputy chairman of the territorial election commission for remote electronic voting (TEC DEG), claims that the system is technically built in such a way that no one has access to information who filled out which ballot. Behind this is complex mathematics and cryptography. An electronic newsletter is generated on the user's device, and not on any servers, and enters the system unchanged. When voting, the user's browser downloads an application - the blind signature protocol, which processes the ballot in such a way that the system that knows to whom it issued the ballot does not know how it is filled out. And the system that received the completed ballot does not know to whom this ballot was issued. The bulletin has a sign that is not identifiable, not comparable, Artamonov explains.

And comparing everything by logs, on servers is a technically extremely difficult task, although not to say that unrealizable, Oleg Artamonov added.

He also pointed out that in 2020, more than 1 million people voted remotely on constitutional amendments, and there was not a single evidence that someone was later called by the boss for a "wrong" vote, despite the fact that such cases usually quickly become public.

Moscow platform

According to DIT, the voting system used in 2019 was implemented by their employees using the Ethereum blockchain platform. Representatives of Kaspersky Lab participated in the working group on ensuring remote voting in the elections to the Moscow City Duma in 2019. They also provided expert support to DIT in the process of organizing a remote vote on changes^[7] Constitution^[8].

And in May 2021, Kaspersky Lab went in a row to develop the capital's remote electronic voting system through the Internet. For 160 calendar days, for which the term of work is calculated, the company will receive about 270 million rubles.

The main tasks of the work, as follows from the TA, were to ensure the process of submitting applications by citizens for participation in the DEG, automate the consideration of applications for participation in the DEG and notify applicants about its progress, ensure the formation of lists of citizens admitted to the DEG, ensure secrecy and anonymity of will, automate interaction between users of the system.

The goals are also to automate the provision of information on the progress of the DEG for public observers, the process of obtaining information on citizens' appeals and complaints, and the process of generating statistics on the progress of the DEG.

Kaspersky Lab has its own blockchain platform on Ethereum for voting called Polys. In addition, the company is developing a new voting product - "Polys.GOST." But in May 2021, Kaspersky Lab said that neither Polys nor Polys.GOST would be applied as part of the execution of a new agreement with DIT for the development of the system.

Differences between the federal platform and the Moscow

Functionally, the Moscow voting system on the mos.ru platform, perhaps, differs primarily from voting on the public services portal in that a Moscow voter can vote several times. In other regions, this option is not yet provided. Re-voting means that the voter has the opportunity to again receive electronic ballots and change his choice (or repeat it) three hours after the previous vote. As a result, the last choice will be counted. Officially, this is called "delayed voting."

Such a mechanism insures the voter against technical problems (for example, if a smartphone has sat down or a browser is stuck), and also to some extent protects against being forced to vote for a particular party and/or candidate: if the voter has at least three hours left before the end of the vote, then he will have time to vote.

Both systems use blockchain and smart contracts. But one of the technical key differences is that in the Moscow system, when counting votes, it is first supposed to decrypt ballots, after which they are grouped in decrypted form and the results are determined. And in the federal CAS DEG, individual ballots are not decrypted. They are first grouped in encrypted form, and then the summary bulletin is decrypted. This is possible due to the use of homomorphic encryption technology.

Also in the federal system, a special cryptographic algorithm is used to anonymize voters, which is called a "blind signature." This algorithm in the DEG system, which allows you to separate the personal data of a voter by which he receives a ballot from the identifier with which the ballot will be written into the system, is quite well studied by the world cryptographic community. The Moscow system uses a mechanism for anonymizing its own development.

It is noteworthy that after the end of the voting procedure, the CEC published the results of the DEG from all regions except Moscow on September 17-19 - they appeared with a significant delay on the afternoon of September 20. Despite the fact that earlier after voting on amendments to the constitution, the results of electronic voting became known in an hour.

Moscow authorities explained the delay by the fact that the results of the DEG in the capital were recalculated several times by the morning of September 20. Such a need was associated with the possibility of delayed voting, which was provided only to Muscovites, said the head of the DIT of Moscow Eduard Lysenko^[9].

Everything by morning was recalculated several times just in case due to the fact that, unlike the whole country, we had a unique function for people - delayed voting, RBC quotes Lysenko. - This created new features in the implementation of the blockchain, which is implemented for us "Kaspersky Lab"

Who is responsible for what in the DEG

The Ministries of Digital Affairs and the CEC of Russia are customers of the project, within the framework of which Rostelecom is responsible for the infrastructure and application layer of the federal DEG system. And Moscow voters, as mentioned above, use the platform provided by the Moscow government. Below we will discuss in detail the roles of participants in the federal DEG system.

The first link for access to the DEG is the public services portal. It implements the function of informing and submitting applications for participation in the DEG, as well as the identification and authentication of citizens. The operator of the public services portal is the Ministry of Digital Services.

The CEC of Russia, an independent federal state body with exclusive powers in the preparation and conduct of elections, is responsible for the DEG. All the main functions - from checking the presence of the voter in the lists of members of the DEG, providing him with the opportunity to vote on specific ballots, to taking into account the wishes, counting the votes and summing up the voting results, are implemented using the DEG software and technical complex.

The DEG software and technical complex is separated from the portal of public services and e-government infrastructure.

Role Allocation

Operator of the Unified Identification and Authentication System (ESIA) - Ministry of Digital Affairs of Russia. In the process of DEG, ESIA is used as the DEG participant identification and authentication system external to CAS. ESIA administrators do not have access to DEG CAS and do not combine the functions of DEG CAS administrators.

Operator of EPSU - Ministry of Digital Affairs of Russia. At EPGU, a citizen of the Russian Federation in electronic form submits an application for participation in the DEG, the sending of which is confirmed by entering a SMS code sent to the mobile phone number indicated in the EPGU user profile. The application in the form of an xml file is signed by the electronic signature of the EPSU and sent to the CEC by means of the SMEV. The result of the application processing is displayed in the personal account of the ESGU user. EPGU administrators do not have access to DEG CAS and do not combine the functions of DEG CAS administrators.

Registrar - CEC of Russia. The registrar processes the DEG applications received, as well as generates data for compiling the DEG participant lists. In addition, he is the holder of the registrar keys for each vote and the signature service blindly of the public key of the DEG participant, providing access to the ballot.

The organizer of the DEG is the territorial election commission of the DEG (TEC DEG). The functions of the organizer are implemented with the help of the CAS component of the DEG "Organization and Implementation of DEG," which has a distinction of access rights using certified information protection tools. The main functions of the DEG organizer include:

• generation of a key pair and separation of the first enciphering key of the bulletin between holders of key parts;
• loading of initial data on votes received from election commissions organizing elections;
• downloading data on submitted and recorded applications from the registrar to form a list of DEG participants;
• generation of a request for creation of registrar keys for each vote;
• generation of a key pair for generation of the final encryption key of ballots for each vote;
• start and stop voting;
• assembly of the key from parts received from holders of the key part;
• loading of the assembled decryption key into the blockchain (commission key);
• start of vote counting: formation of the final ballot and its decryption;
• receipt of data on voting results and protocol on voting results;
• signing of the protocol on voting results by electronic signature.

Internal observer. A participant who monitors the voting process from a specialized facility equipped with means of access to individual nodes of the Distributed Vote Storage and Accounting component. He can perform actions to search for data in a distributed database, view this data, view voter lists, initial data. Has access to advanced system monitoring metrics. With the help of a specialized open source tool, it can upload and check the correctness of decryption of the final bulletin. Does not have access to other components of the DEG CAS.

External observer. Any user who monitors the voting process from the surveillance portal that publishes voting statistics on the Internet. It is possible to get the download of transactions from the blockchain network in the form of files published on the surveillance portal. Using open source software tools, an external observer can:

• check the integrity of the transaction;
• check cryptographic proof of bulletin correctness;
• check correctness of total ciphertext;
• check cryptographic proof of decryption correctness;
• check correctness of summation of partial decryptions of summary bulletin.

Organizing election commissions. Election commissions organizing elections and determining the results of elections in the territory: the CEC of Russia, IKSRF, TEC, prepare initial data in the GAS "Election" (ballot text, protocol form) for transmission to the DEG organizer through the "air gap." After the voting is completed, data on the voting results are received from the organizer of the DEG for download to the GAS "Elections."

Background and prospects of remote electronic voting in Russia

The DEG format in Russia was first used in three constituencies in the election of deputies to the Moscow City Duma on September 8, 2019 on the basis of a voting platform developed by the DIT of Moscow. Then this experience was experimental in nature, and not without problems: there were failures due to malfunctions in the operation of ballot encryption equipment. ^[10]. Installation of such equipment is prescribed by information security standards.

The remote voting platform developed in Moscow was also used during the vote on amendments to the constitution, which took place from June 25 to July 1, 2020: the system was used in Moscow and in the Nizhny Novgorod region. The CEC then considered the remaining regions insufficiently prepared. In addition, the Moscow platform was used in the by-elections of municipal deputies in September 2020.

In September, the format of online voting was also tested in the by-elections to the State Duma in the Kursk and Yaroslavl regions. And in December 2020, CEC Chairman Ella Pamfilova said that by 2024 electronic voting in the elections could be introduced throughout the country.

We can confidently say that remote electronic voting throughout the country can be carried out by the next federal campaign, and not by 2021. The next federal campaign is 2024, "she said, the[11].

Looking at how actively the state involved voters in the DEG in 2021, widely promoted it in the media and social networks, we can say that the participation of as many citizens as possible in it seems very important for the state. And in Moscow, in particular, there was an initiative to conduct the program "A million prizes -# Choose Together" for Muscovites who will vote in the elections of State Duma deputies from September 17 to 19. The Moscow Chamber of Commerce and Industry held a drawing of apartments among the participants of the DEG registered^[12] program^[13]

At the same time, before the elections in September 2021, Ella Pamfilova gave a large interview to Vedomosti, in which she stated that the CEC was not in a hurry to further expand remote voting.

We are not in a hurry, since the expansion of this additional to the main type of voting should occur as confidence in it increases and the socio-political consensus expands. In the meantime, when some, like the Communist Party, demand to ban it, and others urgently introduce it throughout Russia, we must measure each step with our ability to ensure the safety and reliability of the system at each round of its development, "Pamfilova told Vedomosti."[14]

And the Ministry of Digital Affairs, after the completion of remote electronic voting on September 19, said that their department was technically ready to scale this system throughout the country^[15].

Foreign experience

A number of countries have been developing DEG systems for more than 10 years, but almost no one has yet switched to large-scale use. This is due to the technical complexity of implementing the requirements necessary for voting, including the confidentiality of the will, the openness and transparency of voting, protection from interference from outside, and the peculiarities of local elected legislation.

The impetus for the development of such systems was the appearance of distributed registry technology - blockchain. It allows you to close a number of problem areas related to safety and transparency. Now the blockchain is used as the main element of the DEG.

The first country in the world to use the electronic voting system in republican elections is Estonia. Actually, at the moment, it is the only country where remote electronic voting is fully applied. This option is available to all voters in the country.

This type of voting with the result taken into account in Estonia has been held since 2005. In 2019, about half of voters chose this option in the elections to the European Parliament in 2019^[16]?. Remote user authentication is implemented using electronic identity cards (ID cards), which include certificates for electronic signature.

In Norway, for example, the DEG system has been developed since 2008. It was first used in parliamentary elections in 2011. And in 2013, a separate group of voters was allowed to vote via the Internet during early voting as an experiment. But on a full scale, the system is not yet used in the elections, as the issues related to ensuring the secrecy of voting, as well as protection from external and internal threats, remained unresolved to the end.

Switzerland has also taken the path of development of the DEG for 10 years, but it has not yet decided on the widespread use of such systems. In 2019, the Swiss Post announced a contest among official "white" hackers to search for vulnerability in the voting system, and they were found: a critical vulnerability that allows various manipulations of the results of the expression of will. After that, the project was suspended, and at the end of 2020, the Swiss government announced plans to resume testing^[17].

In the United States, the online voting system works in several states of the country, but in the summer of 2020, cybersecurity researchers discovered a number of vulnerabilities in it. As it turned out, attackers can fake the votes of the population, doing this as invisibly as possible for members of election commissions. In addition, even if there was actually no attack, the authorities will not be able to prove that the results are correct, researchers from the University of Michigan and Massachusetts University of Technology argued^[18]. Thus, the United States is not yet talking about deploying electronic remote voting nationwide.

Notes