Why e-voting is still a bad idea

Turnout in the 2023 parliamentary elections turned out to be the highest ever, with as many as 72.9% of those eligible casting their vote. The media immediately ran reports that even higher turnout could be achieved by introducing universal, electronic forms of voting - voting over the internet - e-voting. Is that a good idea?

What should voting be like?

Elections are one of the most important tools in a democratic country, which is why they should guarantee us:

• anonymity;
• the uniqueness of a vote;
• trust in the voting system;
• directness;
• and be universally accessible.

These are the four pillars that, in the eyes of a citizen, guarantee the honesty of the voting and the election result itself. Of course, traditional paper voting isn't ideal and has a number of gaps. There's the possibility of falsifying elections, buying votes, but on a larger scale this becomes unprofitable and difficult to carry out.

Meanwhile, creating an IT system that conducts an anonymous and at the same time unique vote, and ensures trust, is a difficult challenge. Perhaps an impossible one to achieve.

How can IT systems support voting?

Electronic elections, e-voting, is a concept that covers a wide range of IT solutions used in referendums and general elections. Here we distinguish:

• Electronic visualisation of election results - IT systems are used to present and visualise election results, turnout, etc. The Polish National Electoral Office (PKBW) has been using such solutions for years and it's available on the website wybory.gov.pl.
• Voting using so-called "voting machines" - specially prepared devices in polling stations (voting machines) replace traditional ballot papers. Votes are cast by voters on a special dedicated device, which simultaneously counts the votes and sends them to a central system. Brazil and the USA use such devices.
• Voting over the internet - votes are cast remotely from any location using the internet and the voter's device. The receiving and counting of votes remains under the control of a central computer system. An example of a country that has implemented this kind of solution is Estonia.

Anonymity versus the uniqueness of a vote

A voter has the right to the privacy of their views and doesn't have to reveal their political preferences. The obligation to ensure secrecy and order during voting rests with the chairperson of the district electoral committee (Art. 49 § 1 of the Electoral Code).

A voter, when collecting a ballot paper, confirms their identity by presenting an identity document and signing. This is a requirement so that votes are unique. One person - one vote. Although the voter themselves doesn't remain anonymous, their view does. A ballot paper dropped into the ballot box won't be linked to them in any way. It stays in the box until the votes are counted.

The work of the district electoral committee is supervised by poll watchers and social observers. Local vote counting is inherently controlled from within, by independent people. What's more, if someone tries to mark a ballot paper (an extra inscription, a symbol, etc.) in order to identify a citizen, such a vote is considered invalid.

Can an IT system ensure the anonymity and uniqueness of a vote?

One of the problems of electronic voting is ensuring the citizen's anonymity and, on the other hand, making sure that an eligible person is voting and doesn't cast more than one vote.

People working in marketing, e-commerce or advertising know well how IT systems can be used to track a user's activity online. It's easy to identify the purchase of a specific product in an e-shop with a specific person.

To ensure the uniqueness of elections, a citizen has to log in to the voting system or voting machine, or sign their vote with some certificate, e-ID or something else that unambiguously identifies them.

It's a matter of trust, or lack of it, whether electronic voting systems don't allow a vote to be linked to a citizen.

In 2003, a group of scientists published a security report concerning the AccuVote TS 4 voting computers. In it they revealed an enormous number of security flaws, which affected, among other things, voters' privacy.

Meanwhile, in 2004, an independent audit of the source code of the Belgian DigiVote software showed programming errors that could reveal the identity and the cast vote of a voter.

Trust in the voting system

The method of voting and counting votes should carry with it high trust among society and be understandable to everyone, not necessarily someone with technical knowledge.

Using a ballot paper, you're able to check whether the paper is correct, unmarked, cast your vote and drop it into a sealed ballot box. At the vote-counting step, independent people (the district electoral committee, poll watchers, social observers) check exactly the same thing. Whether the ballot paper was correct, unmarked and whether a valid vote was cast.

Of course there's a risk of falsifying the results, incorrect vote counting, bribes for district electoral committees, intimidation, blackmail, bribery. This requires enormous involvement across the whole country and abroad. The counting and casting of votes isn't centralised, and to influence the election result, you'd have to attack hundreds of polling stations.

Manipulating votes in a few of the 31,497 voting districts (the 2023 parliamentary elections) has practically no influence on the results, especially when turnout is high. The more people vote, the more people have to be manipulated, bribed to falsify the elections. Even campaigns of the hide grandma's ID type couldn't manage to change the election results.

And what does trust look like in the case of an electronic electoral system?

Regardless of whether we use "voting machines" or voting over the internet, we have the problem of trust in the hardware and software we vote with. A sheet of paper is simple and verifiable by anyone. In the case of hardware and software, you have to have specialist knowledge to be able (if it's even possible) to check whether the machine or software we cast our vote with doesn't change it to a different one.

Many doubts remain on this subject:

• How do you check the correctness of the hardware in a voting machine?
• How do you check the correctness of the voting software?
• Is the home computer you're voting from not infected with a virus?
• Has the voting software you download and install not been infected?
• Is my vote definitely anonymous and not linked to my identity (login, password, ID card)?
• How is the voting result from the machine transmitted and counted?
• Who creates such software? Private companies? The government?
• Who services and updates the devices?
• Who has access to the data they collect?

Of course you can use various kinds of checksums, external software or hardware for verification... but then the problem is moved somewhere else. Do we trust the external verifying system?

In 2006, the team of Prof. Mirosław Kutyłowski presented various methods of infecting software used for casting votes over the internet. The researchers managed to change votes in a way imperceptible to the voter.

At the DEF CON conference, hackers managed many times to attack voting machines, change results, show something different on the screen and even play the game DOOM on these machines. Infecting the software or hardware manufacturer doesn't seem like a difficult or unrealistic thing.

Another issue that raises a lack of trust is the transfer of voting results from such a machine or your computer to the system that gathers the votes. Transporting the equipment to a central location to download the result from the computer, or maybe plugging in an external flash drive and sending it, or maybe sending the data over the internet? Postal voting raises a lack of trust, let alone transmitting votes over the network.

Each of these elements raises a lack of trust and is exposed to various kinds of cybercriminal attacks, from swapping a flash drive to Man-in-the-middle attacks. There also remains the question of trust in what was saved on the device or sent over the network. If such data is encrypted, then independent people (poll watchers, social observers) won't be able to verify it.

And what about voting from your own computer? Are you able to state that it doesn't contain any malware? Maybe you take care of your computer and it's always updated, but do others? And what about logging in to the voting system? Does everyone have correct safeguards, a hard password and two-factor authentication? It's hard to believe, let alone trust.

At the very end there remains some central computer system that gathers all these votes delivered to it. It has exactly the same flaws that voting machines or voting from your own device have. We're not able to check the correctness of the software or hardware on it and, worse still - only a handful of people have access to it and know where it's located.

Even if the votes aren't changed on the voting machines or on our computer, we don't know what happens on the side of the counting system. Not so long ago we lost trust in the RCB system, which was used for electoral propaganda.

In 2004, in Carteret County in North Carolina, over 4,400 votes gathered by UniLect Patriot voting computers were lost. The problem may have turned out to be software freshly updated by the manufacturer.

Attacking a single element is enough to change the fate of millions of people. That doesn't sound good.

E-voting and turnout

As can be seen on the basis of the 2023 parliamentary elections, you don't need an electronic voting system at all to increase turnout. The undoubted advantage of such a method, however, is increasing its accessibility for people who, for some reason, can't go to polling stations.

Admittedly, the solution to this problem is postal voting, but let's assume it doesn't exist. The only European country that has introduced voting over the internet is Estonia. Despite the enormous financial outlay to enable voting over the internet, the increase in turnout was negligible.

In 2005, 1.9% (9,317) of people used this method of voting and after 18 years of the system's operation, that is, in 2023, it only just exceeded 50%.

The reason for such a small increase may be a lack of trust in the technologically complicated voting system and the very process of casting a vote: logging in, a PIN, confirmations with a cryptographic card requiring a special reader, downloading and installing software, etc.

For many voters this system remains too complicated compared with logging in to a banking system, but unfortunately it has to be that way to be, to some degree, resistant to cybercriminal attacks including phishing attacks.

All of this means that the use of electronic voting, and the difficulties in using it, can actually lower turnout.

Are electronic elections cheaper?

Printing and distributing ballot papers, employing thousands of people who verify and count the votes seems to be an expensive solution as opposed to an electronic IT system, where it's enough to click and the vote is cast.

Reality, however, seems to be different, because most often the costs of creating and maintaining the IT voting system are omitted. The next step is omitting the expenses imposed on the voter so that they can vote electronically. In some such systems, as for example in Estonia, the citizen had to buy a special device to read the cryptographic card.

To this we should add the expenses related to handling IT system failures and creating backups of such a complicated system.

In Ireland, an electronic voting system was bought for 52 million euros. These were NEDAP voting computers. It was later assessed that the system doesn't guarantee the secrecy and accuracy of elections required by the electoral law, and as a result its use in elections was abandoned.

In 2005 the United Kingdom abandoned plans to introduce voting over the internet and via SMS, justifying this by the higher costs and greater risk of abuse than in the case of traditional voting, or even by traditional post.

Poland 2050's electoral blunder

Szymon Hołownia's Poland 2050 experienced a political blunder during the second round of voting for the party's chairperson on 12 January 2026. The internet vote was annulled because of technical problems - the system suddenly stopped accepting votes at around 9 PM, making it impossible for many party members to cast their vote.

The provider of the Interankiety platform denied failures on its side, suggesting an organisational error, e.g. failing to keep an eye on the survey pool or the subscription. The party initially suspected a hacker attack or external interference (it reported the matter to the ABW and the prosecutor's office), but there's no evidence of this; more votes were recorded than there were eligible members. The first warnings about problems with the system appeared as early as December 2025, but the party didn't react.

The excess votes in the Poland 2050 vote resulted from sharing the survey link on social media, which caused a sudden surge in traffic and blocked the system. The company Interankiety confirmed that no excess votes were actually added to the results - only valid ones from authorised email links were counted, but the party misinterpreted the data.

Poland 2050 politician Marek Uss published recordings of the voting process on the X platform (formerly Twitter), which may have made access easier for people outside the party and exceeded the survey limit. The system automatically blocked the account after a large number of requests, making further votes impossible - it wasn't a cyberattack, but an organisational error. The party initially reported the matter to the ABW and the prosecutor's office, suspecting interference, but the analysis ruled this out.

Summary

Over the last 20 years, practically nothing has changed on the matter of electronic voting. The electoral systems used in Estonia or Brazil carry with them a lot of controversy among political parties and the voters themselves. The technology is difficult to understand and verify, as opposed to a piece of paper, a pen and an X drawn with it.

Complicated technologies like blockchain, or the increasingly popular artificial intelligence and the threats related to it, don't contribute to trust in an electronic voting system.

Perhaps one day elections will look different, perhaps they'll stop being anonymous. Perhaps then electronic electoral systems will come into everyday use.

Today, in my opinion, that's unlikely.

Sources