eVoting

In many ways this is a negative story but in one crucial way, it is a very positive story. The negative ways will shortly become clear. The positive way is this: that we have an example of well-founded citizen activism resulting in the correct thing being done, all via people power and a mailing list.

The central figure in our story is Margaret Synnott, who happens to also have been the founder of the Maynooth Netsoc. Margaret came from a family backgroundThere is at least one more world-class programmer in the family, Paul McGaley, but I will not tell his tale here. deeply involved with computers. Her dad worked for an insurance company, and “in the 70s he quit and started programming [as] a sole trader kind of bespoke software company”, back when then was pretty rare. He also did “computer classes for local kids”, but as is common for many parent-child relationshipsMy own in particular, where I have resorted to leaving the Usborne Pop-up Book of Computers and Coding artfully lying around the house in case someone gets bored one day and they happen to pick it up. Mags didn’t really get involved until someone else introduced computing to her, which happened to be a class in school in the early 90’s.

In university, Mags started out doing engineering in DCU but got into computers in a serious way and quit engineering to do CS in Maynooth, following it all the way through to a PhD. Indeed, her final year B.Sc. supervisor:

suggested writing on PR-STV because he had heard they were bringing in evoting, so that turned into a research project about the Nedap system and then from there I decided to start a lobby group. Although it wasn’t technically a lobby group, but that’s what I was calling it at the time! I also started the PhD to follow through with all that.

I write this around the time of an Irish general election, and election fever (which is big in my family) is, I feel always enhanced by the wonderful algorithm that we and a pitiful handful of other countriesMalta, and the Australian Senate. use. It’s called Proportional Representation, Single Transferrable Vote and for the uninitiated, essentially involves filling out your ordered preferences amongst the total pool of candidates available. Then a series of rules determines the winners by attempting to best match the candidates with the highest ordered preferences to the seats. You can see the article above for more details, but the key difference is transfers – in other words, preferences other than the first one. In the Irish system, a candidate who is “transfer friendly” – i.e., maximally appealing to the widest set of voters – has a much better chance of getting elected than a candidate who is very good at appealing to their base support. This is of course if their base support is small enough not to be a full quota on its own.

Anyway, all of the mechanics around tracking and accounting for transfers do appear, to both trained and untrained eyes, as being quite complicated. It’s not a first-past-the-post system where everything is over and done with, within a few hours.Our recounts often go on for days, for example. (Indeed, a friend from Britain has commented about how much more intelligent she feels as a voter going into an Irish voting booth, having to make all these preferential ordering decisions.)

However, that’s not to say it couldn’t be improved:

It’s quite old, so it wouldn’t be better than more modern proportional representational systems. Of course it depends on what metric you’re using, but it has some disadvantages, one being how complicated it is. People spend years learning more and more details about it, and I’m glad I didn’t actually attempt to implement it because it’s really hard! Also, it’s not the application of a formula, it’s algorithmic, so there’s no shortcut – you have to go through the steps of the algorithm, and you cannot, even in principle, boil it down to something simpler. Especially the way we do it here, because the order that the ballots are in affects the result. Which, by the way, makes our version non-deterministic and non-monotonic.

Seasoned computer scientists are probably wincing now. Mags’ last sentence just implied that if we ran exactly the same counting procedure with the same votes, we might get a different result: hardly a property we’d really like in a voting system. However, all is not lost, because in return for surrendering complete determinism, we do actually get something which is practical to execute, and gives:

… a fairly good representation of people’s preferences. If there is a clear winner in first preferences they are very likely to win a seat and then, if there is a clear second preference, they’re probably going to get a seat…. It’s fairly good at representing preferences. But it is indeed complicated to execute.But don’t feel too bad for poor old PR-STV. There is a famous result showing that no election system can be perfect, given some fairly small constraints. So it’s not perfect, but neither is anything else, ever.

Democracy is important, and the operation of the machinery of democracy is important, and Mags was well positioned to do something with that machinery after her interest in evoting was ignited by her supervisor’s suggestion. From her time setting up a student society, she has some experience of setting something up and trying to make it go, and she has the technical background to understand and analyse what’s going on. The motivation, however, was, in many respects, good-old fashioned disbelief:

I knew that electronic voting was probably not going to be done well in Ireland.

In fairness to Mags, this is not just cynicism. One of the sections of her PhD thesis was about how difficult it is “for government bodies/public bodies to procure decent IT systems.” There have been a large number of public software projects which have failed very dramatically, with cost over-runs and functional failure and so on. There are many reasons why this is the case, as Mags outlines:

I was thinking about the difficulty of retaining staff who understand the way that IT actually works in government. The Departments tend to have low retention of people with decent IT skills [for salary or opportunity reasons]. So they end up then relying on the vendors for advice and information. There’s a point where you don’t know enough to know that you don’t know, but it seems very short-sighted to me to say, “We’ll buy a thing from this person who’s selling it and not have someone else give us advice as to whether it’s what they say or not”.

There are counter-examples, of course. At the time, Revenue were quite informed, although perhaps the quality has gone down since then, but for their major projects:

… they had a single responsible owner, they had a plan where they started with a small design and they planned how to expand on the design, and it was really an example of a well-designed software system. They had a group of companies that were providing it, developing it together, and I think they had some outside consultants talking about it as well. But they must have had somebody inside Revenue with at least some kind of a clue.

But back to electronic voting:

When it was first proposed in around 1999/2000 I was in France doing Erasmus, so it wasn’t that big in my mind. I just remember my husband CianEx-colleague of mine, and initial collaborator on this book. saying to me, “Aaagh, they’ve got electronic voting, it’s going to be so terrible”. I didn’t really look into it until my final year. Then, once I realised just how bad that system was, and after reading other experts like Rebecca Mercury, I also saw that it’s such a really hard problem, it’s not just that we were going to do it badly: it was that it was inherently not doable. I just knew that if somebody didn’t do something about it, then we were going to be stuck with it for twenty years. So, once I finished my final year project, I said to myself, well, I know that I know a bunch of people who care about it, who understand it, and I think that I can get them to work together to do something about it. So that summer I told a bunch of people that I was going to start a lobby group with the aim of forcing myself into doing it, if you know what I mean! So I talked to Colm MacCarthaigh and he said he could host a mailing list, and the plan at that stage was, get a bunch of people to join the mailing list and then we decide what to do.

Perhaps surprisingly, but to my mind testament to the loose co-ordinating power of the Internet, the lobby group just stayed as a mailing list the whole time. They talked about other options, and had one face-to-face meetingEndearingly known as “meatspace” meetings. Or possibly meatings. in 2003. Everything else was conducted on the mailing list: open, transparent, accountable. They had a couple of celebration events, but everything else was just done on the list. They called themselves the ICTE - Irish Citizens for Trustworthy E-voting.

It’s worthwhile now taking a moment to actually look at what the problems with this particular implementation of e-voting were.After all, the ICTE were in favour of e-voting, just not this particular version of it. The answer is pretty simple, actually - the great benefit of using pen and paper for voting is that there is a physical record of what’s happened, i.e. your ballot paper, and there is no danger that your paper will spontaneously mutate into a vote for the party with better hackers once it disappears into the box. However, in the e-voting design as taken up in Ireland, the votes are stored only in the memory of the machine in question. There’s no independent mechanism for verifying that once a person has voted a particular way, that it was actually recorded that way. Although the things that hackers can do can often seem magical - i.e. inexplicable - to non-hackers, in this case, it’s pretty intuitive that just as human memory is unreliable, computer memory is also prone to being overwritten or tampered with, without an easily verifyable audit trail that this is the case.

There were also a number of best practices which were not adhered toSee, by way of illustration, this ICTE presentation for more. – for example, testing of the system was incomplete, and some of those tests failed, and the results of the failing tests were not communicated correctly. After a presentation from ICTE, a parliamentary committee recommended the suspension of the rollout, but a week later reversed that decision and then a contract for 7000 machines was signed the very next day. While I’m sure, sure, this decision was completely above board, the fact that an even larger contract was signed for more machines the month later does lead one into wondering if perhaps other motivations than pure correctness of implementation was to the forefront of the mind of government.

Again, for the computer professionals, this sentence in the following Irish times article is probably enough: “Mr McCarthy also said international computer experts recoiled in horror when he told them the final counts would be collated using the Microsoft Access database programme.”It’s not that MS Access can’t add numbers - it absolutely can. It’s just that it’s way more complicated than it needs to be, and the more unnecessarily complicated something is, the more places you can hide “messing about”.

The question arises, having looked at the system, how Mags and others actually established that the proposed system was quite so broken given the implicit vote of confidence given to it by the governmental purchasers and tenders. Mags has very much her own opinion:

My reading of it, and this might be a little bit prejudiced, but my reading of it is that Nedap came to Ireland and proposed electronic voting to representatives of the Department of the Environment and Local Government. Then the Department wrote a tender document which happened to be fulfilled exactly by the Nedap system, and then they gave them the tender. Nedap certainly were in the country in ‘99, and it is known for sure that they met representatives of the department.

The Minister who suggested it first was Noel Dempsey, the then minister for Environment and Local Government, who apparently was the one who stated that he did not want the possibility of explicitly recording a spoiled vote on the machine; the Dutch machines have a blank vote button for just such a purpose, which was changed for the Irish machines to switch between Irish and English. However, after his initial work in the 1998-2002 period, pausing only to suggest that anyone who opposed evoting was “insulting the intelligence of the electorate”, Dempsey didn’t last long:

But pretty quickly it got passed to Martin Cullen and Cullen was the minister for most of the time that we were operating. Then we met Dick Roche; he was really not listening. He did at least agree to meet with us – Cullen never agreed to meet with us – but Dick Roche did. We were supposed to have forty minutes, I think, and he talked for an hour and a half. At the end he could say that he had met us, but he hadn’t actually engaged with anything that we had to say at all. Finally, it was John Gormley, the final minister we dealt with, who actually said they were going to scrap the machines.John Gormley himself never got in contact, but the progression of announcements about the system didn’t require it: in 2004, they said they weren’t going to use it in the elections of 2005, and then in 2006 they said they weren’t going to use it at all. (Clearly, given that the initial ministerial involvement was all by the Fianna Fáil party, to really kill something off you’ve got to call in the ruthless and psychotic Green Party).

Obviously, this is in many ways a tremendous success, in the sense that a bunch of emails stopped something with rather more momentum than a bunch of emails. The obvious questions are: how did it happen, and why didn’t government just plough on ahead and ignore the pressure compaign?

We were constantly sending out press releases. I was getting, doing interviews for six months, doing radio and TV. There was another guy, Joe McCarthy, who spent thousands of euros of his own money on freedom of information requests. Every time he got some information back, it was damning. The opposition parties were all pretty vocal about it. At the time I had a lot of respect for Eamon Gilmore. He listened, he got it, people sent him emails and he replied and took it seriously and seemed to actually get what was going on, spoke very articulately about it. The pressure got to the point where.. I mean, Cullen, I think, would have just ploughed on through. Indeed, he went ahead and did an official launch [for evoting] and all that just gave us more attention. In the end, I think they just said, let’s get an independent commission in to rubber-stamp this. And I don’t know if they knew what they were getting in that commission because the commission really took it seriously and did a lot of very thorough research.

Another moment in Yes Prime Minister springs to mind, where Sir Humphrey (the solicitously scheming civil servant) explains what exactly independent commissions are for. But without being cynical about it, the government actually got their money’s worth with this commission, even if not the result they were perhaps hoping for, because (as Mags says) they genuinely did their homework. The commission published a series of reports:Somewhat ironically, their domain name has expired, but see e.g. this paper.

The first one, they said that they were not willing to endorse the system for the elections upcoming at the time. The rationale being that they had put quite a lot of time into doing what they could, but they hadn’t had time to do what they considered satisfactory testing or examination of it; in other words, there are enough concerns being raised that have not been adequately answered, so we’re not going to endorse this system. They said they wanted more time to examine it, and took that time, and then in 2006 they said, as it is, it’s not suitable for use. They gave a long list of things that needed to be done for it to be usable, which were obviously not viable [to fix in the system as-is]. They were fairly explicitly barred from talking about VVAT, the Verified Audit Trail [which is printing out a paper copy of the vote, for cross-checking, fail-safe purposes and so on] because that was our position as a lobby group. They did allude to it, because most of the admissions they received mentioned it and say that it’s necessary, that it lowers the bar for other tests if you had this other record of votes. They were not willing to state the position we had, which was, if you don’t have VVAT, then you don’t have a usable system.

Remarkably, by a combination of getting in the news cycle as the other half of “the government should do X/the government should do not X”, and an unexpectedly independent independent commission, Mags and her colleagues had succeeded in putting a lot of pressure on the government. The commission membersChairman: The Hon. Mr. Justice Matthew P. Smith; Members: Mr. Kieran Coughlan, Clerk of Dáil Éireann, Ms. Deirdre Lane, Clerk of Seanad Éireann, Dr. Danny O’Hare, Chairman of the Information Society Commission, Mr. Brian Sweeney, Chairman of Siemens, former Chairman of Science Foundation Ireland; as per the Internet Archive. had only one name that Mags recognised – an ex-President of DCU – and:

three other people who, as far as I know, had no particular interest in the specific topic. They weren’t people that I knew of otherwise. But for whatever reason they just really took it seriously and got some good people on board. They never got in contact with me, obviously, but they did get in contact with my supervisor, and he ended up being one of their advisors for the research process.

What could account for this rather startling outbreak of competence?

I don’t know. We couldn’t figure it out at the time because we were sure that it was going to be friends of friends of the government and [there would be boringly friendly noises], and they would rubber-stamp it. But they didn’t.

One of the things worth bearing in mind, which might partially account for this unwarranted success by a grassroots lobby group is the distinction between matters perceived to be technical and non-technical in Irish society. (In Irish politics in general, perhaps.) Matters in the technical realm are usually perceived to be of irrelevant detail. Even if they are relevant, the people who matter (™) don’t have time to master them. In this way of looking at the world, a lobby group which succeeds in preventing “something technical” from being enacted is nothing to do with real life, and therefore there would be less powerful forces ranged against it. But, as always in politics, it’s also a question of presentation and style, quite apart from substance:

I think we also succeeded in portraying ourselves as technical professionals. We made a point of going in suits whenever we were visible, and we never used placards or anything that would associate us with [other kinds of protests]. I mean, there are people doing really great work who use placards, but they are generally completely vilified by the Irish press, and so we were very careful to be effectively saying, “we are IT professionals, PhDs, we’re not technophobes by any means”.

Essentially, “we are not Socialist Workers, please take us seriously.”

So I think that helped us to get taken seriously. There were also a couple of people in the media who kind of took it on. George Hook decided that he was going to talk about it every day. I distinctly remember him saying, “People are sending me text messages to tell me to shut up about e-voting but I’m not going to shut up about it until it’s gone!” There was a couple of people who took it on board and ran with it a bit.

One interesting side-point, which turned out to be another little filigreed set of cockups in an overall disasterous tapestry, was the matter of the storage of the machines. Once the voting machines weren’t going to be used in at least the elections they had intended to be used in, they had to be put somewhere secure while the further testing and reports were done. Furthermore, they’re actually computers, so you can’t just chuck them in someone’s back yard – they’re only verified for operation between certain temperature ranges, they probably won’t take to being rained on too kindly, and so on. It looks like the government didn’t really have a plan for storing the machines after the first hiccup in the programme:

Once they decided that they weren’t going to use them in that election, they then started arranging storage. It’s the Department of Local Government that looks after storing ballot boxes and all that kind of thing. They separately organised storage around the country for the machines. There were people who signed 99-year leases for storing machines. There was one guy who got into trouble because his son set up a company to build a facility, to prepare a facility that was suitable. But in fact there wasn’t anything else available, so that was ok. The son made available what they needed to store them. But the difference in rental costs between one district and another was amazing. Then, once they realised they were never going to use them, they took them all to a barracks, and they were sort of stacked in piles there. And then - I was going to say it’s not that long ago but it’s probably 5-7 years ago now, they decided to scrap them. I contacted the company that were recycling them, and they were not allowed to give me a piece. I just wanted a module, or something!

These inefficiences ran into the millions of euro, if I recall correctly. However, the storage question continued to deliver interesting headlines well after the prospect of the machines ever being used in any election had been well and truly deep-sixed, so I guess the Irish people got some value for money there.

Other lobby groups

The e-voting lobby group/mailing list didn’t receive a lot of support from other lobby groups, as such – more from concerned individuals, as per George Hook. Digital Rights Ireland went a different direction, with in-person meetings, and were not highly engaged on the issue, despite Colm MacCarthaigh being involved in both. There are, unfortunately, damn few other Internet-related lobby or advocacy groups looking at long-term actions, with Ireland Offline probably being the most prominent of them. Ultimately though, they are lobbying for a particular piece of the resource pie, or that the pie be expanded some way. It’s a commercial rights organisation. It’s not really a group arguing for a fundamentally different way of doing business, or a way of being an engaged citizen, or anything like that. Fair play to them in all the things they’ve achieved, but ultimately, you’re not going to get out of bed a freer citizen because of Ireland Offline.

Given how successful Mags and colleagues have been, the question does arise whether she has any thoughts about how what she achieved could be extended, or why it isn’t being extended, or why, other than DRI, there isn’t anyone plugging into that kind of way of being:

That’s interesting. I’ve talked about the pirate party, and there have been at least two previous attempts to get a pirate party going. I think the pirate party is a very clear example of something that could have only ever risen out of the Internet, and has really leveraged the advantages of the Internet. I saw a lot of potential in it. I have since withdrawn from it, because it’s taken very much a negative stance. For what it’s worth, I don’t currently see any way of being involved in politics without taking the approach of “accessing your frustration and building on that”. [I had thought the core people behind it] were very much behind the idea of doing it all publicly and on a very professional level. The pirate party that’s starting in Ireland, I thought, was going to go in that direction, but there are people who are kind of complaining for complaining’s sake, trying to set things up before they open it out generally. It just didn’t fit with what I had hoped for it.

The pirate party platformTry saying that three times quickly. also differs from country to country. If the original thesis was that “copyright and patent law is not capable of dealing with the modern world and modern technology”, and we need action on that, the problem with the Irish party is that:

They tend to argue that it was never a good thing, that it was always a bad idea. Irish IT people are as jaded about politics as Irish people in general. There are - I’m interpreting a lot, but there’s certain elements of Irish culture that make change difficult and make people inclined to accept that this is the status quo and ah sure, you wouldn’t be able to do anything about that. The ICTE effort was so hard, I thought about starting a pirate party myself, but ended up not doing so. I like to think that it would have gone a little bit differently if I had, because I would hope that some of the people who were involved in ICTE would have got involved. But I think that people are cautious about appearing silly and so that’s one of reasons that people haven’t taken the pirate party seriously.

I guess the interesting thing in Ireland that most of the political parties are all, in essence, the pirate party – except they plunder different kinds of things.

Reflections on public service

The public service does some things well, and some things less well, and in general is about as consistent as any other organisation with a couple of hundred thousand employees is.With the possible exception of the Catholic Church. That is to say, not very consistent at all.

Having said that, the Irish government does seem to have enjoyed a particularly fraught relationship with IT projects, making (in the words of Mary Harney, ex-Tanaiste) all the “classic mistakes”. PPARS, a project to unify the health system’s payroll and personnel systems, which was budgeted to cost €8 million in the 1990s, and ended up costing €220 million in the late noughties, apparently still with significant functionality gaps.

There is a subtler point here as well, leaving aside my sniping from the sidelines. Summarised, it’s essentially technical exceptionalism. By saying that the government is going to be hopeless at IT projects generally, we are effectively saying that if the government wished to procure clothes-washing services, it would go out to the market and write up a tender for it, the white goods would arrive, and they would wash the clothes, and that would all be fine. Why? Well, because there isn’t much that’s open-ended and creative that’s necessary for clothes washing: the purpose is clear, the deliverables are clear, and so on. For the government to go to tender for something as significant as e-voting or something else technical which could be meaningfully distinguished from the washing I discuss above, they need to have somebody more skilled to make that work.

Indeed, when you combine this with, for example, the story behind healthcare.gov, where an ex-colleague, Mikey Dickerson was instrumental in turning around a mega-expensive and mega-incompetently-executed project, one does end up with the lasting impression that perhaps the government should have its credit card taken gently but firmly away from it, shortly prior to having it cut up. At least when it comes to technical projects.Now, just to be absolutely clear – failure rates for both private & public sofware projects are basically as bad as each other, except for companies making their living from it. But the outsourcing of expertise model has problems.

However, I think that as we progress through time, we’re going to find more and more of government’s operations which are surrounded by – founded on – technicalities, which rely on technology for their implementation if not their whole raison d’etre. Consequently it’s more and more dangerous for government to be isolated from the bread and butter of what it is that it’s supposed to be doing.

It may all be a fantasy to try to improve this, though, given the general background motivations in politics. Consider Mags’ interpretation of the initial governmental motivations for e-voting:

The government also seems to not recognise the import of what they’re doing. [It was] clear from what Cullen and Aherne talked about e-voting that it was all about image for them. They wanted us to appear to be technically advanced. They weren’t even technically advanced enough to realise that doing this in the first place was wrong.Indeed, this story from RTE makes it clear that the Taoiseach’s desire for electronic voting was a comparative one; i.e. comparing quickness of election results between different countries – although he is not comparing like-with-like, so the comparison may be meaningless. He also issued disparaging remarks about reverting to the “peann luaidhe”, instead of a having a technologically sophisticated system. That remark has really interesting connotations in Ireland, since it is the Irish word for pencil, but it has really strong connotations of school, and also, bizarrely, self-hatred.

That is, of course, just Mags’ interpretation. One odd thing is that it’s not as if there are no technically competent people to hand, engaged with government on some level. They don’t tend to do well at the ballot box, but there are a number of non-career-politician individuals who have done great things, such as Dennis Jennings. In general though, when you look at the roll calls of government ministers, a number of them famous, they are usually teachers or other roles with quite a lot of spare time. Maybe a handful of them have run a business before, but other than that – not a lot.

Then the question becomes: how could we move to a situation where the technical underpinnings of the business of government are increasingly insourced?

That’s a really good question. I think we need to move from clientilism into something like proper national politics. I’d love to see a really decent local government where the person who’s responsible for potholes and answering your local questions is your local representative. And then national representatives are dealing with national issues. And I think at that point then you can have have people who are more competent in whatever dimension. For the moment, though, we have dynasties and people who are spending their time in their local constituency with non-national issues so I don’t think you can fix one without the other.

Despite our oft-documented post-colonial sense of self-hatred, it’s genuinely not the case that we lack world-class people. I mean, I hate Michael O’ Leary as much as the next left-thinking person, but Ryanair must, by inspection, have world-class mastery over infrastructure and in particular logistics: movement of planes, repair, their turnaround time is famously low, all of that kind of stuff. They must have it absolutely down. So why do we have these continuous failures in the technical domain?

It’s not a fundamental flaw in us. I’m just saying that Irish culture doesn’t reward being outstandingly good. It doesn’t reward doing anything about the thing you’re complaining about. There’s a lot of cultural barriers to improving the situation.

(If anyone feels like setting up a new pirate party, let me know.)

Now, given all we’ve seen here, is there anything that can be done to save a positive role for government in the Internet?