Keywords

1 Introduction

As democratic elections increasingly become ‘cyber elections’, calls for measures to safeguard election outcomes and promote electoral integrity are growing [34, 27]. Voting technologies are of particular concern, given potential security vulnerabilities and possibilities for hacking or interference. Online voting systems attract notable attention because they are touted as offering the greatest benefits to voters in terms of access and convenience [14, 35], but pose the greatest risks to compromise election outcomes or public confidence should something go awry [36]. To counteract such effects, there are increasing calls from scholars and practitioners [3, 9, 26] that online voting systems used in binding elections be verifiable, notably meeting the requirements of end-to-end verifiability (E2EV) - a concept which ensures that voters can verify that their votes have been correctly cast and recorded (known as individual verifiability [22]) and any member of the public can verify the final tally of votes (known as universal verifiability [15]). Such mechanisms are regarded as “a revolutionary new paradigm to enable secure and transparent elections” that could enhance confidence in election outcomes [37].

In response, many jurisdictions around the world have sought to adopt verifiable online voting systems [37]. In the Netherlands, for example, an online voting system with individual verifiability was used in the 2004 elections of the “waterschappen” in Rijnland and Dommel [23]. Likewise, in Norway, the online voting system used in the 2011 and 2013 local elections was said to be individually and universally verifiable [24]. In Estonia, the option of individual verifiability has been available since 2013 and the option of universal verifiability since 2017 [15]. Finally, Switzerland, which has one of the longest-running online voting programs, now legally requires an online voting system to provide “complete verifiability” [20]. Despite these examples and a commonly shared perception that E2EV is the future of online elections [33] however, verification mechanisms continue to be regarded as “new and novel concepts” [2].

A glaring example of a jurisdiction where verification is regarded as nascent is in Ontario, Canada. Ontario is one of the longest and largest adopters of online voting (based on the frequency of elections and the number of voters eligible to cast online ballots). Yet, most deployments are not verifiable. They are either conducted by systems without verifiability or election administrators opt out of enabling the mechanism. Online voting activity in Canada is concentrated at the local level without intervention from higher orders of government. Most countries that offer online voting have involvement from national governments leading the charge for systems with enhanced security. In Ontario, however, decisions about whether to use online voting, the type of system and its features are at the sole discretion of local governments.

In this article, we draw upon focus group data collected from a large (City of Markham) and small (Township of Ignace) municipality in Ontario, Canada as well as their vendors to better understand municipal experiences with advanced online voting systems and the considerations that affect adoption and deployment. Both municipalities introduced verifiable online voting systems for the first time in 2022 with very different resources, capacity, and history of use. Their experiences help explain why verifiable voting systems are not more readily used in Canada.

We use the term ‘verifiable voting’ to refer to online voting systems that offered individual verifiability to voters. This article is a part of an interdisciplinary research project focused on examining administrator perceptions towards, and experiences with, verifiable online voting systems, including E2EV, in Canada. While this article focuses on municipal experiences deploying individual verifiability, a second contribution systematically addresses the barriers to municipal uptake of verifiable voting via a province-wide survey with municipal administrators.

By examining the election experiences of Markham and Ignace we accomplish three goals. First, we explore factors that prompt the adoption of verifiable voting at the local level and those that may deter governments from using them in both large and small municipalities. Second, we consider the benefits and challenges of using verifiable voting in lower-level elections. When local governments use advanced voting technologies are they satisfied? Do they see improvements in security, fraud or voter confidence? Would they opt to use such technologies again? Does municipal size make a difference? Finally, we discuss how to overcome barriers to the implementation of verifiable online voting systems to improve electoral integrity in lower-level elections.

The Ontario Case.

Online voting in Canada is most frequently deployed by municipal governments for local elections, but it is also used by Indigenous communities, unions, political parties, and by some provincial and territorial election agencies in more limited capacities [38]. Currently used by municipalities in the provinces of Ontario and Nova Scotia, adoption in Ontario is by far the greatest given the number of municipalities that run elections (49 in Nova Scotia compared to 414 in Ontario) and the longest-standing history of implementation, commencing in 2003. About 3.8 million voters were eligible to cast an online ballot in the 2022 Ontario municipal elections.

Online voting implementation in Ontario happens contrary to common drivers of usage [17]. Many cities have sizable senior populations and lack robust internet infrastructure. Majority of municipalities drop paper ballots [36]. Under Canada’s multi-level governance structure, the sub-national governments (provinces and territories) are responsible for writing the acts that govern local elections. In Ontario, the Municipal Elections Act includes a provision to deploy alternative forms of voting and gives municipalities autonomy to make their own decisions about which voting methods to use. This discretion has resulted in implementation approaches that differ on the period in which online voting is available, the process to authenticate voters, the voting modes used, the types of online voting systems (e.g., blockchain) and their abilities to verify election results. This latter consideration is our main interest in this article.

The first five election cycles (2003–2018) where online voting was offered were largely characterized by the use of relatively ‘generic’ technology, which relied upon web-based platforms without verification capabilities. The 2022 municipal elections, however, saw an increasing number of municipalities introduce individual verifiability (see Table 1). To the best of our knowledge, such systems were offered by four of six vendors that provided services to 102 municipalities (out of 222 in total that used online voting). Two vendors - Scytl and Neuvote/ Smartmatic - offered individual verifiability by way of a downloadable application where verification was available for a limited time after casting a ballot. Two other vendors - Simply Voting and Voatz - offered web-based verification after the close of the polls. With Voatz, voters also had the option to verify their ballots in the voting application.

Case Information.

Markham and Ignace chose vendors with verification applications. The process involved downloading the application from the App Store or Google Play to their mobile device. Upon casting their ballot, voters had 30 min to verify that their vote was cast as intended. For Scytl’s Verify app voters were required to scan the QR code on their voting confirmation screen and enter their voter PIN and date of birth to access a secure preview of their ballot and confirm that their selections matched how they voted [32]. In the case of Neuvote/Smartmatic’s TIVI Verifier app voters scanned a QR code on the voter confirmation screen to review their selections and confirm their correctness, however, no additional credential was required.

The City of Markham was the largest of twelve municipalities in Ontario to first adopt online voting in 2003. At the time, Markham housed IBM Canada’s headquarters, which led many to view the community as a technical leader [40]. The city has continued to be a leader in online voting by forming community partnerships, surveying voters, and trialing new technologies to improve voter experiences and innovate elections. The decision to use a verifiable online voting system was motivated by increasing global public skepticism around elections, notably disinformation. Officials saw it as a means to strengthen the integrity of the vote. Online voting in Markham’s 2022 election was available from October 14 to 24, while paper ballots were offered at select polls from October 20 to 22. Paper ballots and touchscreen voting were also available at the returning office the entire voting period. To cast an online ballot, voters input a 16-digit numeric code from their Voter Information Letter (VIL) and date of birth.

Table 1: Ontario municipalities with individual verifiability in the 2022 elections*
Full size table

The Township of Ignace, by comparison, used online voting for the first time in 2022. Administrators became interested in verifiability since they were expecting a contested election. Allegations on social media suggested that someone may hack the election, and administrators liked the additional assurance that verification gave voters in the election outcome. The administration had limited experience with online voting and “no knowledge of the logistics involved”, however, the township had run an all-mail election in 2014. Online voting was the only voting option in Ignace’s 2022 municipal election, available from October 11 to 24. To vote online, voters input a 25-digit alphanumeric code from their VIL and date of birth as a second credential.

2 Literature Review

Choosing Verifiable Voting (or not) and Low-Stakes Elections.

Previous research on verifiability of online voting has explored “why election organizers still largely opt for systems that are not verifiable and how this could be changed” [41, p.555]. Research suggests that it is easier for election administrators to decide in favor of “black-box solutions that are directly advertised by the vendors” [41, p.559]. This assumes that vendors do not offer verification mechanisms by default, and that administrators do not necessarily have the capacity to actively request them from vendors. The reasons why vendors do not offer online voting systems with verification mechanisms, according to [41], has to do with costs of developing them, lack of promotion by the market, and their profitability. This explanation suggests that municipalities may not opt for verifiable voting systems. We explore this below in the context of Ontario.

Further insight into municipal rationales for adopting online voting systems with verifiability (or not) can be found in the literature differentiating low- and high-stakes elections. This strand of literature suggests that if online voting is ever acceptable, then it should only be in the context of low-stakes elections [6, 13]. While research on online voting claims that no binding public elections can be considered low-stakes [6, 13], elections research frequently defines local elections as such [5, 30]. Scholars argue that unlike in high-stakes elections, the financial costs of an online voting system is of particular concern for low-stakes elections [11, 16]. Furthermore, in terms of security, “a weaker threat model is [seen as being] suitable” [16]. E2EV studies, in particular, have established that economic feasibility can impact system uptake [2]. Scholars argue that despite benefits, verifiability “obviously raises the price” of an online voting system [10]. Thus, the costs of verifiable online voting systems may be a deterrent for municipal adoption, especially since many cities have small budgets. An additional deterrent related to security is the perception that verifiable systems increase the risk of voter coercion such as vote-buying [42] or provide voters with an ability to prove to others how they voted (see [8] for more on receipt-freeness). Municipalities might be hesitant to introduce verifiability if they believe it can increase the risks of vote-buying.

Another consideration involves the perceived costs of voting in low-stakes elections. Studies show that voters are more willing to forgo their ballots in lower-level elections, seeing them as low-stakes [4]. On this basis, municipalities may be less inclined to opt for verifiable online voting systems because they may not see the purpose of deploying additional security. Furthermore, the public policy and political economy theory assumes that in democracies it is not only public institutions and politicians that define policies, but also voters, who “tend to focus on the direct effects of the policy change and underappreciate the indirect effects” [7, p.3]. Thus, it is possible that voters do not demand verifiable online voting because they might focus on the direct effects of the policy change (like increased costs and complexity) and underappreciate indirect effects (like increased security). Based on this another explanation for municipal adoption (or lack thereof) may be voter demand and/or enhanced public confidence.

Government Perceptions, Benefits, and Challenges.

To date little is known about government experiences with and perceptions of verifiable voting systems. Most verifiable voting implementation has been driven by higher order governments and analyses of these deployments have been conducted by computer scientists focusing on system security [10, 12, 29] or usability [18]. Few contributions are situated in the social sciences [24] and none of which we are aware address election administrators’ rationales for adopting verifiable systems nor their perspectives on the outcomes of these trials. Moynihan & Lavertu [19] suggest looking at administrators’ technology preferences. They find that election administrators’ decision-making regarding technology is frequently shaped by biases. Due to these biases municipalities may be less inclined to try something new (like a verifiable online voting system) because they prefer systems that they have already tried. Similarly, there could be information gaps wherein some local bureaucrats may not understand the meaning of E2EV and the benefits it offers. On the flip side, the “faith in technology bias”, is a potential driver for using verifiable systems as the most advanced ones.

Administrators’ experience is important because, at least in Canada, officials play a key role in deciding whether verifiability will be implemented. To enhance the security of online elections we need to understand what stops administrators from implementing verifiability, challenges faced with introduction, and how to mitigate these obstacles. This article addresses these gaps by providing empirical evidence of administrators’ perceptions of verifiability and their experiences implementing it. Highlighting these experiences can help address barriers to greater uptake in Ontario and elsewhere.

3 Case Selection, Data and Approach

Case Selection.

This article primarily draws upon focus group data collected from two municipalities - the City of Markham and Township of Ignace - that used a voter verification application for the first time in 2022. Focus groups were conducted with municipal administrators and online voting service providers. We used a most-different case selection approach [28] to select the municipalities, which differ by size, urbanity, geography, population characteristics, internet infrastructure, online voting history, and vendor. Markham tendered services from Scytl, who has been providing online voting services in Canada since 2014, including in Markham. Ignace, by contrast, selected a newer company (Neuvote) who formed a partnership with an international corporation (Smartmatic) to provide online voting for the first time in an Ontario municipal election.

The Township of Ignace is the only municipality that used the Neuvote/Smartmatic TIVI Verifier application. It has a population of 1,200 persons, is based in the north and predominantly rural, has a sizable senior population (30 percent) which includes many seasonal residents, has poor digital infrastructure, and had not used online voting before. Selecting among other municipalities that provided individual verifiability but were served by another vendor, the City of Markham fit the criteria of the most-different case selection approach. In comparison to Ignace, Markham is a large municipality with a population of 328,000, is located centrally, classified as urban/suburban, has a balanced population in terms of age, excellent digital infrastructure, and has used online voting in five previous elections. The City of Markham also had the highest number of verified ballots of all municipalities based on available data.

The selected cases represent two distinct paths that municipalities in Ontario can take to move away from generic online voting systems to verifiable ones. One example is a municipality that has not used online voting before and tries a verifiable system for their first deployment, while the other has a history of use and transitioned to a verifiable system.

Data and Approach.

As noted, this article is part of a larger study focused on understanding voter and administrator perceptions toward, and experiences using, verifiable voting systems. In this article we primarily draw upon focus group data obtained from municipal administrators and private sector vendors. To supplement and enhance this information, we also reference interview data with other municipalities that used verifiable voting. Four focus groups were conducted between November 4, 2022 and March 21, 2023: with election administrators in Markham (6 officials) and Ignace (3 officials) and with Scytl (3 officials) and Neuvote/Smartmatic (3 officials). Each focus group lasted between 1.5 and 2 h and followed semi-structured guides (one for municipal administrators and one for vendors) that were provided to participants in advance. All groups were structured around three themes: (1) the 2022 experience with verifiable voting; (2) barriers, and (3) solutions to E2EV adoption. Focus groups were recorded with participant consent and notes were taken. Some documents and additional information were shared by participants afterward via email.

We chose focus groups because the group environment allowed us to communicate with a wider range of stakeholders representing the public (e.g., clerks, treasurers, IT personnel, and election managers) and the private sectors (e.g., CIOs, product managers and IT staff). We performed note-based analysis [21], with video recordings allowing us to verify quotations. For analyzing focus group notes we applied qualitative text analysis techniques. We coded the text along the three predefined themes - drivers and barriers, benefits and challenges, and solutions - that guided the focus groups.

Finally, to better understand why so few ballots were verified in the other municipalities that adopted verifiable voting we administered a short questionnaire between July 4 to 19 to those cities and towns. All municipalities were contacted by email and asked to either take part in a 30-min interview by phone or Microsoft Teams or submit written responses. Seven of thirteen responded. Five municipalities answered our questions in an interview format, while two submitted responses via email.

4 Findings

Drivers and Barriers to the use of Verifiable Online Voting.

What factors prompt municipal adoption of verifiable voting? Likewise, which considerations may deter local governments from using them? Focus groups with election administrators in Markham and Ignace and their vendors identified several drivers and barriers (see Table 2 for the summary). Interviews with other municipal officials confirmed them.

In line with the literature, both election administrators and vendors in Ignace and Markham noted ambiguity regarding the meaning of E2EV and verifiability as key barriers to uptake. In the administrator focus groups, even members of the same election team assigned different meanings to verifiability. One official saw it as “an extra step in building confidence, increasing transparency and accountability”, while another highlighted its “added complexity” for stakeholders. A vendor further highlighted the knowledge gap by noting that of the 100 + clerks they spoke with, only around 20 percent understood the difference between E2EV and generic online voting systems. Confusion of verifiable voting was further seen in interviews with municipalities that used the service but did not have any verified ballots. One administrator observed that they used the verifiable option “by default”, unaware that they could have opted out. Another official, where ballots were verified, remarked that a “better understanding of processes” would have helped implementation.

A second related barrier is the absence of a definition of E2EV or verifiability. This gap was felt by both the first-time online voting user (Ignace) and long-time adopter (Markham). As an election administrator from Markham noted, “[we] still try to understand E2EV better”. Another election administrator from Markham remarked that their definition of verifiability has changed over the years, stating, “in previous elections we said that our elections were verifiable, but our definition evolved.” Without definitions of these terms uptake in the municipal sector is likely to remain low.

Third, administrators cited concerns of many administrators that verifiable voting systems present a higher risk of vote buying since voters can show their unencrypted ballot to third parties. They noted that this was a reason many chose to opt out of the feature. Among other barriers, vendors cited the higher cost of verifiable systems, election administrators’ preferences for systems they have already tried, and a lack of external pressure from voters, candidates, the media, and higher levels of government to implement verifiable online voting. As one vender representative remarked, “Generic solutions are low cost. They [administrators] do not necessarily understand and value the differences in the systems. Some people just do not want a change. And nobody told them that they need to”. This correlates with the literature findings on the “status-quo bias” and “own judgment bias” defining the choice of technological solutions by election administrators [19]. Another official further emphasized that “a lot of times the low price is what matters the most” and is a key factor that decides RFPs.

It is surprising that election administrators from both Ignace and Markham did not identify cost as a barrier to verifiable voting adoption as the literature suggests [2, 10], despite the fact that the financial resources of these two municipalities vary significantly. Cost was also not raised as a factor in any interviews we conducted with other municipalities that offered individual verifiability. Typically larger municipalities can have election budgets upwards of $500,000 whereas some small towns have budgets of less than $25,000. Additional input from vendors clarified why cost may not have come up. One employee noted that another vendor offered all of their municipal clients the option of using an application for individual verification at no extra cost. This business strategy could have affected election administrators’ perceptions of price.

Finally, an additional barrier is the need to review and re-write processes and policies when introducing verification mechanisms. This perception came out in the focus groups and interviews with larger municipalities. Many administrators in small towns did not see a need to revisit policies so long as testing of the verification mechanisms was conducted beforehand. Some did not even require testing. Our discussions suggest that small and large municipalities approach the need for revised policies differently, increasing the adoption effort for large places, albeit those cities have more staff to facilitate updates.

Moving on to consider drivers that motivate verifiable voting use in local elections, education was identified as driving early uptake. A vendor representative remarked that the diffusion of verifiable voting systems in Ontario happened, at least partially, due to their efforts to educate the market by disseminating videos and hosting webinars for the municipal sector. The other vendor and the municipal administrators echoed these comments. While large municipalities in our study already knew about verifiability, some smaller towns learned about it via a vendor open house hosted by Markham.

A second driver is the expectation of a contested election. As noted, the evidence-based aspect of online voting systems with verifiability mechanisms was of particular importance for Ignace as a precautionary measure given the allegations that someone may try to hack their election. Likewise, interviews with other municipal users echoed this sentiment as one official commented, “[We used it to] lend more validity and trust to people’s vote.” This was a common theme across municipalities of all sizes.

Finally, administrators’ preference for the most technologically advanced systems was identified as a third driver. When describing their system, one vendor referred to it as “revolutionary” and “slightly ahead of the curve”. This presentation may encourage adoption among municipalities looking to innovate with the latest technology - what the literature called the “faith in technology bias” [19]. It could also act as a barrier in more risk-averse cities. This sentiment of innovation was communicated by both the smallest and largest municipalities we spoke with.

Benefits and Challenges of Using Verifiable Online Voting for Local Governments.

What are the perceived benefits and challenges local governments observe deploying verifiable voting systems? Do they perceive improvements in security, fraud, or voter confidence? Likewise, are they satisfied, and would they use a verifiable system in a future election? Overall, several challenges and benefits were reported. Not surprisingly, there were differences in reported benefits and challenges based on municipal size, resources, and previous experience with online voting.

One challenge identified by election administrators in Markham and confirmed in interviews with other larger municipalities that used verifiable voting is the need to review processes when introducing verification mechanisms combined with the lack of established procedures. This perception came out in the focus groups and interviews with larger municipalities whose comments focused on the need for procedures relating to dispute resolution and handling ballot challenges. While vendors often offer policy suggestions to support wording changes to municipal legislation, 2022 was the first time that the vendors who participated in our focus groups used verification applications in government elections in Canada which meant that some supports were not in place like they are for other areas of online voting. As one administrator remarked, “The vendor came with the [verification] tool but not the processes of how to use it in Canada […]. We needed to do our own research […]. We created the processes [for the Canadian context]”. This example highlights the challenges associated with early implementation of a technology and the work needed to ensure processes are in place to support deployment. The need for internal capacity was further emphasized from an administrator when stating, “I do not know if I would do it [introduce verifiable online voting], if not for my team [IT-skilled people]. It is uncomfortable”. As an administrator in Markham noted, “…we had to understand the process for how the system would enable us to cancel a ballot [if challenged after verification] and then how to reissue the voter new credentials to vote. And we had to figure out how to handle those in real time.” In an interview another larger municipality noted that they were unclear on what would happen should a voter select the “not my selections” button on the verification app. The administrator remarked, ““What would happen if someone clicked that button? I wasn’t entirely sure.” Having more knowledge to work through these processes would enable greater municipal confidence.

A second challenge is the complexity of deploying the verification application and communication of information between vendors and local governments. Any new component in election deployment adds complexity working through and testing the new aspects [43]. This sentiment was observed by both municipal administrators, albeit to different extents, due to differences in resources, previous experience, and perhaps even vendor selection. Testing and proactively devising solutions to potential problems took time and additional care. Ensuring adequate testing was particularly challenging for Ignace, albeit it was less about the complexity of procedures encountered by larger cities. The Apple version of the verification application used in Ignace was only in French. Despite contacting Apple, a change was not made prior to the election ending, which may have affected uptake among English speaking voters. This challenge may be linked to a lack of previous experience with online voting on the part of the election administration or the vendor who offered the service in a municipal election in Canada for the first time. Some, but not all, small municipalities we interviewed also did less testing. “I maybe checked two of them [ballots]” remarked one official. By comparison, testing was less of an issue for larger cities. As a Markham official pointed out, the added benefit of having experience and an IT team was conducting numerous tests: “We did test it really thoroughly beforehand. I think we conducted four or five rounds of user testing, [and] ran several 100 test cases involving the app.” The experiences of Ignace and Markham testing the verification applications before deployment were quite different. These experiences were associated with differences in resources, previous experience, and perhaps even vendor selection.

Educating voters about the verification application was a challenge for both Markham and Ignace, however, it seemed to be a bigger obstacle for smaller municipalities. While Markham had the greatest number of verified ballots (4% of voters), Ignace reported challenges, despite education efforts. The voluntary nature of individual verifiability and the fact that it was separate from the voting process was unclear to some Ignace voters and affected their voting experience. As one administrator remarked, “the app should have been brought up even before we brought up the online voting process. They [voters] thought it was mandatory but it wasn’t.” In addition, some voters were unsure whether their vote had been successfully cast when seeing the additional instructions and QR code. In comparison to Markham, which is urban, has a balanced population in terms of age, and excellent digital infrastructure, Ignace provided some insights for other jurisdictions that are rurally based, have poor digital infrastructure, and greater proportions of elderly voters. Many Ignace voters cast online ballots from public laptops at polling stations because they required assistance. Most voters did not have a device to download and use the verification application in the 30-min timeframe.

Municipalities that took part in interviews confirmed these sentiments noting that they would handle voter education differently next time. In many cases places with few to no verified ballots used one or two channels to communicate verification with voters, and in some cases, information was not circulated until part way through the election. One small municipality, for example, educated voters about verifiability via a public information session that was recorded and posted on the municipal website. All municipalities with verified ballots posted information on social media and dedicated election pages. They also embedded videos explaining the process. Markham’s approach to include verification details on the voter card seemed to have the best conversion.

A final challenge that affected smaller municipalities to a greater degree was the acclimation of races. It is customary in many small towns to have some contests acclaimed, meaning that there is no challenger and no need for an election for that race. One municipality we interviewed had all races acclaimed except for the school board position, which is often perceived as a lower salience contest. The clerk attributed the low number of verified ballots to the fact that voters were less concerned about checking the accuracy of the ballot since the bigger ticket races were not included. It is likely that competition for bigger ticket races drives verification. This could be tested in future research.

Moving on to benefits, Markham highlighted that they received far fewer inquiries about election security and integrity than in previous contests. While the verification application could have contributed to this, it could also be explained in part as a spillover effect from additional communication efforts undertaken by the city. Based on election administrators’ observation that either using, or learning about, the application, contributed to the “sharp decline in the number of inquiries”, it may be that use of verifiable systems improves voter perceptions of election security and integrity, however, confirmation of this hypothesis would require further testing.

Other identified benefits were greater transparency and security, as a result, the expectation for improved trust in the election and its outcomes: “[with verification mechanisms] you don’t need to trust our results, you can check everything yourself”. Some officials felt that this contributed to the absence of an election challenge, even though one was expected. Likewise, it was observed by administrators in Markham and Ignace and their vendors that verifiability mechanisms provided benefits for dispute resolution by generating evidence for potential disputes: “when using online voting systems without verification, election administrators do not have any evidence to prove the correctness of the election results in case they are challenged, and sooner or later the election results will be challenged”. These sentiments were felt equally among the large and small municipalities we spoke to in follow-up interviews. Transparency and security were the primary reasons cited for implementation. As one clerk commented, “we did it for security”. Another echoed that it was to “lend more validity and trust to people’s vote.” These remarks highlight two questions worth future examination. First, whether the use of verifiable online voting increases voter trust and confidence; and second, whether it decreases the number of electoral disputes.

Thinking about the future, Markham and Ignace were asked about the likelihood of future use. Both municipalities took different positions. Ignace encountered additional challenges, the extent of which are not fully outlined above because some were attributable to implementing an online voting system for the first time or going all online, and not necessarily related to the verification application. The combination of issues arising from these circumstances makes it difficult to isolate feelings about verifiability in general. That said, there was a consensus among Ignace administrators that while they would be open to using online voting in the future it would not be the sole channel and it would probably not include verification, despite its benefits. As one administrator remarked, “I would get rid of the verification, because you already get a message [from the system], your vote has been cast, what else would you need? It created much more confusion. Less is more sometimes.” If they were to use it in a future election it would require more voter education and clearer explanations early on.

Markham, by contrast, was more positive about using verifiable online voting again, including working to expand their definition of verifiability. As one official remarked, “…we definitely had some lessons learned about how we are going to approach this in the future, but it will be a mandatory element of any kind of election system that we’re offering.” Based on the perceived success of the trial there was also a sense that continued use of verifiable voting was now an expectation to ensure electoral integrity. Another official commented, “…verifiability is ultimately in service of trying to assure voters, candidates and all other interested parties that our election is being run with the same integrity that they would expect of a, you know, let’s say, a more conventional voting channel.” For Markham, using verifiability is now a foregone conclusion.

The differences in opinion in Markham and Ignace seemed to be related to their unique circumstances rather than an issue of municipal size. Of the municipalities that took part in follow up interviews, some with populations half the size of Ignace indicated that they would offer the verification application again. Despite having no verified ballots in one town a clerk commented, “Oh my gosh yes. I want to do it again.” The focus from most municipalities was on improving communications to promote voter uptake. However, a couple of cities commented on useability, noting they would need to evaluate future use. One noted issue was accessibility. Voters were required to have a second device to verify their ballots, and this was less accessible to some, notably elderly voters in smaller rural communities. Navigating a QR code could also be difficult if digital literacy was an issue for voters. It was observed that this likely disproportionately affected certain groups of voters.

Another issue was that verification happened differently in municipalities depending on the online voting approach used. Cities that offered only online voting or that had a composite ballot had one code that could be used to verify a vote, however, places without composite ballots that offered multi-channel voting (where voters could switch between internet and telephone voting) had one code for each race. This meant that there was a verification code for up to four races: mayor, councilor, school board, and, if applicable, a regional position. Having multiple codes was communicated as a deterrent for voters since it made the verification process more complex and lengthier. One clerk commented, “We would use it again if it were a bit more user friendly. Now that we have more information you could set-up a printer and people could print their own.” Using one code to verify the entire ballot would be a recommendation for future use.

Solutions for the Greater Adoption of Online Voting Systems with E2EV.

Having identified the barriers to uptake of verifiable online voting systems and the challenges municipalities face in their deployment, we turn to possible solutions to encourage local governments to pursue verifiable systems. Our research provides some initial answers that are of interest to scholars, private vendors, and public and policy communities.

One noted challenge, communicated by both vendors and municipalities, is the lack of verifiable online voting systems on the Canadian market. However, most vendors offer some version of verifiability. This suggests that a key solution is communication across vendors, across municipalities, and between them. Notably, vendors should spend more time talking to each other and educating about verifiability.

A second dimension that came from speaking with vendors was the notion of E2EV as a competitive advantage. One vendor noted that their decision to invest in verifiability was “a conscious business decision”, which, in their opinion, proved to be successful, given the number of municipalities they attracted as customers. Another vendor highlighted that the costs of E2EV development creates “huge barriers” for others to enter the market. This narrative of verifiable systems as a competitive advantage might encourage other vendors that currently do not offer the service to develop it over time. With more options, uptake among municipalities may grow. However, if local governments continue to opt out of verifiability, having a verifiable system could perversely become a competitive disadvantage for a vendor given the costs to develop and maintain it, especially in the context of lower salience elections.

There is also a need for an established, widely shared and “acceptable” definition of verifiability and specifically E2EV to “help election administrators and vendors to build it”. In the absence of such a definition, municipalities are left to come up with their own interpretation or ignore it altogether. As one official remarked, “There’s no one understanding, or definition of verifiability so municipal returning officers aren’t prioritizing this feature as part of their procurement.” Additionally, both election administrators and vendors emphasized the importance of establishing standards for online voting use, which could provide a forum for a definition. While there are no online voting standards in force for Canadian municipalities currently, some are in development. Should the published standard include verifiability, it could, in the words of one administrator, “pressure” vendors to develop systems with E2EV and election officials to use them. In addition to a clear definition and standards, an administrator in one of our cases highlighted the importance of building a “collective understanding” of the meaning and purpose of verifiability for administrators who write the RFPs and the vendors who provide the services. This understanding is important for municipalities of all sizes, capacities and history of implementation.

Similarly, election administrators in Markham and Ignace identified the need for “a collaborative environment across municipalities” to counter barriers in municipal education and offer lessons learned. One major gap identified was that many municipalities were unaware that their vendor had systems with verifiability. When one municipality called a meeting of other cities with the same vendor, they were surprised that “a number of municipalities didn’t even know that they had the verify app available”. This user group was effective at informing all clients of one vendor, but municipal clients of other vendors may have been unaware of the option. This example highlights the importance of horizontal cooperation among municipalities. Municipal cooperation has been an effective strategy for addressing other election delivery challenges including (1) drafting joint RFPs to lower the administrative burden; (2) conducting joint audits of candidates’ financial statements; or (3) organizing user group meetings for municipalities working with the same vendor. Furthermore, municipalities in Canada have a vast experience in intermunicipal contracting and other forms of horizontal cooperation [31], which can be fruitful if applied to election delivery.

In addition, administrators in our focus groups pointed to greater involvement from academia to support uptake of verifiable voting systems. As one administrator put it, “Right now you have only our municipality saying it [verifiability] is good. Having the academic support would be great and having a review from the academic community is also helpful”. Vendors also emphasized the importance of ensuring that online voting systems are transparent to the academic community to facilitate research and system scrutiny. One vendor remarked, “Right now the basics of that don’t even exist”. Greater vendor transparency and collaboration with scholars could educate the municipal sector about the benefits of verifiability in low-stakes elections. Likewise, one vendor emphasized the importance of creating online voting roundtables with experts, vendors, administrators, and regulators to promote inter-stakeholder cooperation.

To address challenges with voter education the City of Markham highlighted their willingness to share lessons learned with other municipalities. Markham had the largest proportion of voters verify their online ballots, pointing to the success of their voter education strategy. As noted, officials included information about the verification application on the VIL, but were careful not to use a QR code to facilitate voting, which caused confusion in other municipalities. As one official commented, “We…decided we’re going all in on this. So we promoted it in our voter information letter and pretty much anywhere else that we could promote it.” Inclusion on the VIL was not used in Ignace or any other municipalities that offered verifiability. Based on Markham’s conversion it is a key solution to educate voters in future elections. Instructions on the VIL could clarify the voluntary nature of individual verifiability and the need for a second device. In addition, sharing information via social media and on municipal election pages and including demonstration videos were other strategies used by municipalities that were successful in getting voters to verify their ballots.

In addition to voter education, one vendor concluded that improving the usability of verification mechanisms could promote uptake. The vendor acknowledged that installing a one-time use app is a barrier for some voters. Municipal clerks that took part in interviews echoed that downloading an application may not be desirable or usable for all voters. In addition, the 30-min time limit and need for an additional device to facilitate verification were communicated as issues that deterred use. Finally, municipalities that offered multi-channel voting commented that having one code for verification rather than four would be more user friendly and encourage uptake. This latter point has more to do with the approach used, rather than the application itself. However, some municipalities that offered both internet and telephone voting got around this by only allowing verification for internet ballots. This meant that voters had one code for their entire ballot. Enhanced usability of verification mechanisms might motivate uptake and likewise encourage voters and candidates to request such features.

Table 2: Summary of findings
Full size table

5 Discussion and Conclusion

This article identifies factors that motivate and discourage use of verifiable online voting systems at the local level. Barriers such as a lack of voter pressure for verifiable online voting systems and drivers like market education have not been observed by previous research. We also consider the challenges and benefits of implementation and whether the deployment experiences of our cases were perceived as successes. Our analysis of Markham and Ignace’s experiences point to mixed reviews. They also highlight the complexity of using verifiability in local elections. Despite education efforts, the problems identified by administrators supports previous research that online voting systems with verifiability can have low use and satisfaction due to complexity [1]. The low number of verified ballots in most municipalities that used it suggests that online elections in Ontario are at best verifiable but not verified. This raises questions regarding whether being verifiable but not verified is enough [39]. “If the system is verifiable but not verified it may not produce the evidence trail that it was designed to build” [25, p.341]. Involvement from academics to build a common understanding of the meaning and the purpose of verification in online elections and collaboration across academic, public, and private sector communities can build awareness among administrators and voters to encourage the importance of ballot verification.

Another recommendation that can be drawn from this research is for governments to take slow, small steps to build online voting programs and not try to do everything at once. Using online voting for the first time, going all online, and trialing a verifiability app may be too much. Likewise, introducing individual verifiability before universal verifiability may be a stepwise plan to develop sufficient processes, testing, and education to ensure success of implementation.

Municipal capacity and resources also play a role in the ease and success of verifiable online voting implementation. While large and small municipalities face many of the same barriers, drivers, challenges and benefits, there are subtle differences that could affect uptake and implementation. Larger cities spent more time re-tooling policies and procedures compared to smaller places which integrated verification without the additional work. The level of testing undertaken also varied by municipal size and community. Some small municipalities did numerous tests, while others tried the verification application a couple of times. Finally, based on our conversations, education, acclaimed races, and digital literacy and access (e.g., having a second device and navigating a QR code) seemed to impact smaller municipalities to a greater extent.

Leveling the playing field across small and large municipalities requires horizontal cooperation, resource sharing, and municipal collaboration on RFPs and testing. Tiered price offerings based on municipal size is something vendors might consider. Likewise, academics could partner with smaller cities to support implementation and evaluation. As Gebhardt et al. [10, p.32] note: “Procuring an E2E verifiable electronic voting system is not a simple task. This is a question of having the right resources available, both in terms of money and personnel.” Collaboration presents a way forward here.

Future research should assess whether there is a relationship between verifiable online voting use and voter satisfaction and trust. It may be that certain types of technology have positive or negative effects on voter attitudes and orientations. Comparative work could also assess whether the same drivers, barriers, challenges, benefits, and solutions are replicated in other country contexts and what this means for the future of online elections. Finally, studies could assess the opinions of other election stakeholders toward E2EV such as candidates and the media.

Overall, most municipalities that used online voting in the 2022 municipal elections did not offer verification despite having the option to do so. Our data also show that offering verification mechanisms does not necessarily mean that voters will utilize them. However, a key part of usership involves education and communication, which municipalities agree could be more robust in future elections. The solutions presented in this article provide a way forward to encourage vendor development and municipal uptake, contributing to improved electoral integrity in Canada’s online elections.