Electronic voting has been around since the 1960s, and online voting has existed since the internet began. However, it has never been as relevant as it is today. The pandemic forced more than 3 billion people into lockdown. Remote work is increasingly normalized in the corporate world, and hybrid events are now more common than in-person ones.
In this context, boards of directors, shareholder meetings, association assemblies, union elections, municipal councils, and homeowner meetings are increasingly moving towards remote or hybrid formats. But how can the legal validity of these collective decisions be ensured? How can unwanted legal challenges be avoided? In this article, we explain some key concepts to help you understand how online voting works and how it can help you achieve higher participation with less effort and lower costs.
Online voting and electronic voting
There are many types of electronic voting systems. Broadly speaking, they can be classified into two groups: vote casting systems and vote counting systems. Counting systems are the most widely used in the public sector, with many countries employing them in national and regional elections. Vote casting systems are equally technologically mature, but their use is mainly limited to private organizations—companies, associations, cooperatives, etc. One of the most commonly used vote casting systems is online voting, which is why in this article, we use "electronic voting" and "online voting" interchangeably.
Legislation allows the use of online vote casting and counting systems in shareholder meetings, board meetings, association assemblies, union elections, municipal councils, and other governing bodies. To ensure full legal compliance, two main requirements must be met: properly verifying voter identity and ensuring system security. Below, we delve deeper into these two aspects.
Electronic identification methods
The key to ensuring the legal validity of online voting lies in how voter identity is verified. The regulatory framework governing electronic identification services in Europe is known as eIDAS. This regulation defines electronic signatures as a set of electronic data that properly authenticate the identity of the signer. Despite the name, an electronic signature is essentially an electronic identification method. That’s why, in online voting, voters must sign (or provide specific data identifying them) to cast their votes.
Most people are familiar with electronic certificates used for digitally signing contracts. These certificates can only be obtained in person from a recognized authority. A signature made using these certificates is known as a qualified electronic signature. However, the electronic identification regulations also recognizes two other types of signatures: the simple and advanced electronic signatures. These two methods are the most commonly used for verifying voter identity in decision-making processes within private organizations.
In summary, an electronic signature - whether simple, advanced, or qualified - allows us to reliably verify a voter's identity. Thus, any of the three can be used to hold legally valid online votes in private organizations. The main difference between them lies in the level of security they offer. But before we dive into the details of different signature types, we need to understand how the identification process works.
In-person vs. digital identification
An identification process consists of multiple steps. Some steps are more vulnerable to fraud than others, meaning that the overall security level of the process is only as strong as its weakest link. When discussing digital identification, people often focus on potential security breaches while overlooking the vulnerabilities of in-person identification methods. Let’s examine why.
The word "identity" originates from the Latin idem entitas (same entity). Therefore, verifying a person's identity requires two elements: the individual and an officially issued attribute for comparison (such as a passport, driver’s license, or national identity card). Traditionally, this comparison has been performed by trained professionals - police officers, government clerks, notaries, etc. - who are skilled in detecting fraud. However, we’ve all heard of identical twins switching places to pass driving tests, and fake passports can be bought on the dark web for as little as $3,000 or even less.
Some online voting providers claim their systems are completely secure, but this isn’t true. The digital world is just as vulnerable as the real world. The goal is to minimize risks as much as possible, always in accordance with the applicable regulations for each type of organization (whether public institutions, businesses, or associations) and transaction (for example, taking a bus with someone else’s transport card is different from buying a luxury handbag with their credit card).
Identification process in online voting
As mentioned earlier, the security of an identification process is only as strong as its weakest step. But what are the steps in an electronic voting identification process? We distinguish four steps: registration, verification, identification and activation.
Let’s say a publicly traded company is holding a fully remote shareholder meeting. The first step is to compile a voter registry. If prior registration is required, only registered shareholders will be allowed to vote. Otherwise, all shareholders are included. Before voting takes place, adjustments are needed to account for proxy votes and to verify the representatives of legal entities with voting rights. This verification step requires shareholders to submit identification documents such as a passport or national identification card and, where applicable, legal documents linking them to the entity they represent or an authorization for delegated voting.
Typically, these first two steps are handled internally by the organization, without the involvement of an online voting provider. Ideally, the security of the following steps should be equal to or greater than that of the first two. In other words, an online voting provider must ensure that its identification and activation processes are at least as secure as the organization’s registration and verification process. Otherwise, it would be like putting used, low-quality tires on a luxury car.
The third step takes place on voting day when participants access the online voting platform. This is when voter identification takes place. To understand the different security levels in this step, the Security Technical Specifications established in each region provide useful guidelines.
In short, a high level of security requires two-factor authentication. This typically involves verifying something the user possesses (such as their passport number or personal key) and a dynamic piece of information sent at that moment (such as a one-time SMS verification code). This level of security is standard for online banking transactions and is equally reasonable for the types of votes discussed in this article.
The fourth and final step is voter activation (or authorization). At this point, the voter’s identity has already been verified. The objective now is to ensure the integrity of voting records. In other words, to guarantee that once votes are cast, they cannot be altered. This is typically achieved using time stamps - systems where a trusted third party generates a unique alphanumeric key (hash) tied to the exact time of the vote and other voter-related data (such as personal details, IP address, and device information). If the data is tampered with, the regenerated hash will not match the original, signaling a modification.
An alternative to third-party timestamping is blockchain technology, which achieves similar results without relying on a certifying authority.
Simple, advanced and qualified electronic signature
Now that we understand the full identification and electronic voting process, it’s easier to distinguish between simple and advanced electronic signatures. The first ensures voter identity, usually through secure two-factor authentication. The second, in addition, guarantees data integrity via a qualified timestamp.
A simple electronic signature is less secure than an advanced one but remains legally valid depending on the organization and the importance of the decision being made. A simple signature generates a voting record, while an advanced signature produces documents containing all identification evidence, protected by a qualified timestamp. These documents are admissible in court, making legal challenges more difficult.
Lastly, as mentioned earlier, a qualified signature is the most secure type. However, obtaining one requires in-person verification by a recognized certification authority, making fully remote voting impossible.
Choosing the right online voting system
To determine whether your online voting process is legally valid, you must first identify the applicable regulations for your organization and decision type. This legal framework - whether corporate governance laws or your organization's bylaws - will require that voter identity be properly verified. According to electronic signature regulations, this can be achieved using a simple, advanced, or qualified signature. Whichever option you choose, ensure your provider offers secure two-factor authentication and complies with international security standards such as ISO 27001. And if preserving the integrity of voting records is critical, opt for an advanced signature with a qualified timestamp.
We know that the technical vocabulary is not very intuitive. But if you read again this article, you will see that it's actually simpler than it seems. At Kuorum we have been helping public and private clients in seven countries with their telematic voting since 2013. If you have any questions, feel free to contact us, no commitment required.
