ENG

 Riigikohus on Eesti Vabariigi kõrgeim kohus.
Põhiseaduse kohaselt on Riigikohus kassatsioonikohus ja
põhiseaduslikkuse järelevalve kohus. Riigikohtu pädevus
on sätestatud kohtute seaduses. 

- Eesti vabariigi põhiseadus -

Constitutional judgment 3-4-1-4-11

PrintPDF

JUDGMENT
OF THE CONSTITUTIONAL REVIEW CHAMBER 
OF THE SUPREME COURT

 

 

No. of case

3-4-1-4-11

Date of judgment

21 March 2011

Composition of court

Chairman Märt Rask and members Jüri Põld and Harri Salmann

Court Case

Complaint of Paavo Pihelgas for annulment of electronic votes cast in the Riigikogu elections 2011.

Hearing

Written proceeding

DECISION

To dismiss the complaint of Paavo Pihelgas.

FACTS, COURSE OF PROCEEDINGS AND JUSTIFICATIONS OF THE PARTICIPANTS IN THE PROCEEDING
1.
 P. Pihelgas filed on 5 March 2011 to the National Electoral Committee a complaint requesting that the National Electoral Committee would consider annulling the electronic votes cast in the Riigikogu elections 2011. In brief, P. Pihelgas argued the following:
1) a third party might plant a surveillance software into the voter's computer to establish the voter and how he or she voted. The voter application or the general organisation of e-elections do not offer protection against that. Unlike voting in a booth in a polling division, in case of e-voting the voter cannot be certain that a third party will not record his or her choice;
2) P. Pihelgas possesses an experimentally developed virus which, when planted into a computer, sends to the National Electoral Committee's server only those votes for candidates which the virus has approved. Because of safety considerations the virus lacks a spreading mechanism. Due to inadequate organisation of e-elections which is in contradiction to § 44(5) of the Riigikogu Election Act (REA), the voter lacks the possibility to verify immediately after casting his or her vote whether the vote was delivered to the National Electoral Committee's server. After testing the virus, the electronic voting project manager of the National Electoral Committee confirmed that the described attack is not detected by the National Electoral Committee with the safeguards built in the voter application. The testing of the virus was conducted with the full awareness and consent of the test subjects. The OSCE/ODIHR observers filmed the testing on 1 March 2011;
3) regarding the described attacks, the electronic voting project manager was of the opinion that if the attacks are committed by way of computer viruses, which is the only practical way for a mass attack, then CERT Estonia, the Cyber Defence League and other organisations responsible for cyber security will identify the spreading of the virus and will recommend the National Electoral Committee to annul the electronic voting results. Such an opinion is not justified. World experience shows that viruses may not be detected for up to a year. Estonia lacks a system which would quickly detect a computer virus;
4) the current faults of the Estonian e-elections cannot be rectified without amending the organisation of elections. The biggest danger currently arises from the lack of feedback about the receipt of the vote which is a violation of § 44(5) of the REA. The only indication of sending the voter's vote to the National Electoral Committee is a message on the voter's computer screen which the virus or malware can display even when the vote has actually not been sent. The current system does not provide a reliable way to make sure that the vote has been taken into account. One of the cheapest ways would be to print on the back of the polling card sent to everyone a table containing the names of candidates and confirmation words or frases (e.g. “red carpet”) which would be kept only in the central system of the National Electoral Committee and on the paper in the possession of the voter. The malware in the voter's computer lacks access to the confirmation word. The malware will have access to the confirmation word only if it allows the vote to be properly forwarded to the National Electoral Committee. In that case the confirmation word is useless for the malware because the National Electoral Committee has received the vote and the malware lacks the possibility to affect the voting without revealing itself.

2. The National Electoral Committee regarded the 5 March 2011 complaint of P. Pihelgas in the 7 March 2011 letter as a memorandum according to § 2(2)1) and 2) of the Response to Memoranda and Requests for Explanations Act, and responded to the complaint as a memorandum.

3. P. Pihelgas filed on 8 March 2011 to the National Electoral Committee a complaint requesting that the National Electoral Committee would annul the electronic votes cast in the Riigikogu elections 2011 because the electronic voting was organised in an unsafe way. The complaint states that as a response to the previous complaint of P. Pihelgas, which the National Electoral Committee re-qualified as a memorandum, the National Electoral Committee wrote that it can detect all attacks against the electronic voting system. P. Pihelgas deems that statement erroneous and is of the opinion that the National Electoral Committee is not able to identify the activity or spreading of malware. P. Pihelgas justifies his argument as follows:
1) P. Pihelgas has repeatedly demonstrated to independent observers and introduced to the e-elections project manager in writing the ways of attack which are not discovered by the National Electoral Committee. The last such demonstration took place on 2 March in the afternoon about five o'clock and it was recorded by the ETV (Estonian Television) film crew. The National Electoral Committee confessed in its response to the complaint that it did not discover the attack organised on 2 March on the principle of vote blocking: “No such case has appeared in the current elections.” The faults described in the previous complaint of P. Pihelgas cannot become obvious because the program used in the elections sends the information about possible affecting of the vote by a malware only together with the vote. If the malware blocks the voting for an “unsuitable” candidate but shows the voter that the vote has been cast, the vote or the accompanying information about blocking the vote will not be delivered to the National Electoral Committee.
2) the justification that because upon electronic voting “the possible objects and methods of attack and also the time” are known, “the attacks will be successfully detected”, is not substantiated. In the assessment of the information security company McAfee, as at the end of 2010 an average of 55,000 units of malware are created daily. CERT Estonia must not only identify the malware but also analyse it to determine possible actions against the electronic voting software. With seven employees that is already physically impossible, demanding everyone to analyse 16 malwares in a minute during a work-day. Foreign information security companies do not analyse the affect of malware on the Estonian electronic elections software. CERT Estonia lacks a credible potential for detecting and analysing malware.

4. The National Electoral Committee forwarded the 8 March 2011 complaint of P. Pihelgas to the Supreme Court. The National Electoral Committee requested to dismiss the complaint and additionally explained the following:
1) P. Pihelgas addressed the National Electoral Committee for the first time on 26 February 2011 with an e-mail. His arguments and developed software prototypes were analysed by the electronic voting system's technical staff with the e-voting project manager in charge. P. Pihelgas addressed the National Electoral Committee again on 5 March 2011. The National Electoral Committee regarded the address as a memorandum according to § 2(2) of the Response to Memoranda and Requests for Explanations Act because the address contained a request for the National Electoral Committee to consider annulling the electronic voting results. The letter did not address violation of a person's rights but security of the electronic voting system, and it contained proposals for better organisation of the electronic voting system. The National Electoral Committee responded to P. Pihelgas in writing;
2) after receiving the response from the National Electoral Committee, P. Pihelgas filed on 8 March 2011 a complaint to the National Electoral Committee and confirms that he wishes it to be regarded as a complaint with which he requests that the National Electoral Committee would annul the cast electronic votes. Since the National Electoral Committee has already deliberated the request of P. Pihelgas and responded to it substantively and found that there is no basis for the action requested by P. Pihelgas, the National Electoral Committee forwards the complaint of P. Pihelgas to the Supreme Court pursuant to § 72 of the REA and § 38(2) of the Constitutional Review Court Procedure Act (CRCPA);
3) it does not appear from the complaint of P. Pihelgas that P. Pihelgas was not able to vote or that his vote was erroneously polled. It is a complaint filed in public interest. Whereas the complainant has not produced any facts that the electronic voting was organised unlawfully. Substantively it is a memorandum questioning the reliability of the electronic voting system. The National Electoral Committee has substantively responded to the questions of the complainant in a letter of 7 March 2011.

5. The Supreme Court sent to P. Pihelgas a letter requesting an answer to the question whether P. Pihelgas wishes that the Supreme Court would hear the complaint, filed to the National Electoral Committee on 8 March 2011 requesting the National Electoral Committee to annul the electronic votes cast in the Riigikogu elections, in written proceedings.
P. Pihelgas replied to the Supreme Court on 15 March 2011: “Yes, I wish that the Supreme Court would adjudicate my complaint filed on 8 March in written proceedings of the constitutional review court proceedings.”

OPINION OF THE CHAMBER
6.
 P. Pihelgas has filed to the National Electoral Committee in March 2011 two requests prepared as complaints – a complaint of 5 March and a complaint of 8 March.

7. The National Electoral Committee regards the complaint of 5 March 2011 as a memorandum for the purposes of the Response to Memoranda and Requests for Explanations Act.

The Chamber consents to that approach. Pursuant to § 2(2) of the Response to Memoranda and Requests for Explanations Act, a memorandum is an address presented by a person whereby he or she makes a proposal to the addressee for the organisation of the work of an agency or body, or direction of the development of an area (clause 1) or provides information to the addressee (clause 2). P. Pihelgas requested in the complaint of 5 March 2011 that the National Electoral Committee would consider annulling the electronic votes cast in the Riigikogu elections 2011.

8. The 8 March 2011 complaint of P. Pihelgas was addressed to the National Electoral Committee and in that complaint P. Pihelgas requested that the National Electoral Committee would annul the electronic votes cast in the Riigikogu elections 2011 because according to P. Pihelgas, the electronic voting was organised in an unsafe way. After receiving the complaint of 8 March from the National Electoral Committee, the Constitutional Review Chamber addressed P. Pihelgas with the question whether P. Pihelgas wishes that the Supreme Court would adjudicate his complaint of 8 March in written proceedings of the constitutional review court proceedings. P. Pihelgas answered affirmatively.

9. Pursuant to § 69(1)3) of the REA, a complaint filed against a resolution of an electoral committee shall set out information on the resolution. The complaint of P. Pihelgas does not set out which resolution of the National Electoral Committee is being contested. This shortcoming of formalities does not, in the opinion of the Chamber, prevent hearing the complaint of P. Pihelgas. The complaint of P. Pihelgas clearly expresses the request to annul the electronic voting results. Pursuant to § 61(2) of the REA, the National Electoral Committee shall prepare a record concerning the voting results. The said record is a resolution of the National Electoral Committee for the purposes of § 72 of the REA and can therefore be contested in the Supreme Court. The record of the National Electoral Committee ascertaining the voting results can be identified by the Supreme Court even if the complainant has failed to set out the date and number of the record.

10. Pursuant to § 83(1) and § 46(2) of the REA, the Supreme Court is competent to declare the voting results in the state invalid.

The Chamber points out that pursuant to § 46(2) of the CRCSC, the voting results in the state may be declared invalid only if the Supreme Court concludes that the violation of law affected or may have affected the voting results to a significant extent. The Chamber admits that considering the relative importance of the electronic votes in the Riigikogu elections the violations upon electronic voting may affect the results of the elections to a significant extent.

11. As it appears from the P. Pihelgas' 8 March complaint and the 5 March complaint qualified as a memorandum, P. Pihelgas deems the e-voting of the Riigikogu elections 2011 unsafe because with the assistance of a virus or malware in the voter's computer it is possible that the vote cast for a candidate unsuitable for the malware or virus will not be delivered to the National Electoral Committee, but after casting the vote, the voter, due to the virus or malware, still receives a notice that his or her vote in favour of the candidate of his or her choice has been successfully forwarded to the electoral committee, and the electoral committee will not register such a block (see clauses 1 and 3 of this judgment).

In the memorandum, P. Pihelgas deems such a situation violation of § 44(5) of the REA. § 44(5) of the REA provides: “A notice that the vote has been taken into account shall be displayed to the voter on the webpage.” This provision has not been mentioned in the 8 March 2011 complaint of P. Pihelgas. Based on the concurrence of the main arguments of the memorandum and the complaint of 8 March, the Chamber concludes that the said provision has been kept in mind also in the complaint currently heard in the Supreme Court.

12. The Chamber is of the opinion that if the voter receives a notice mentioned in § 44(5) of the REA corresponding to the actual vote cast by him or her, but the actual vote is not delivered to the National Electoral Committee, then it is a violation of a legal right to vote guaranteed by § 56 1) and § 57(1) of the Constitution.

If the electronic voting system does not allow the voter to cast a vote to a candidate who he or she wished to vote for, and does not notify the voter of such an impossibility, then it is a violation of a legal right to vote.

In such cases the voter lacks the legal opportunity to cast his or her vote in favour of a candidate in a manner chosen by him- or herself.

13. § 72(1) of the REA provides: “If an interested person finds that an act of a division committee, a resolution or act of a county electoral committee or a resolution or act of the National Electoral Committee violates his or her rights, the person may file an appeal with the Supreme Court pursuant to the procedure prescribed in the Constitutional Review Court Procedure Act.” § 70(1) of the REA deems an interested person as an individual, a candidate or a political party. Thus, § 72(1) of the REA provides the voter with protection against violation of his or her right to vote by a resolution of the National Electoral Committee. However, a prerequisite to satisfaction of an appeal is violation of the appellant’s rights by a resolution or act of the National Electoral Committee.

P. Pihelgas as an Estonian citizen of full age can undoubtedly be an interested person for the purposes of § 72(1) and § 70(1) of the REA.

14. On the abovementioned bases the Chamber can hear the 8 March 2011 complaint of P. Pihelgas.

15. The matter to be settled is has the National Electoral Committee violated the legal right to vote of P. Pihelgas.

16. As it appears from the memorandum, P. Pihelgas has conducted an experiment with the full awareness and consent of the test subjects proving according to P. Pihelgas that the electronic voting in Riigikogu elections was unsafe as described above. The Chamber presumes that P. Pihelgas participated as a test subject in the experiment organised by himself. As it appears from the circumstances described by P. Pihelgas, the test subjects had to, in the opinion of the Chamber, be aware of that they are casting their vote via a computer infected with a virus.

17. Pursuant to § 72(1) and § 70(1) of the REA, a complaint can be filed only for the protection of the person's own violated rights. Therefore, the 8 March 2011 complaint of P. Pihelgas cannot be filed for the protection of the rights of the other persons who participated in the experiment.

18. If to presume the validity of the circumstances presented in the memorandum and the 8 March complaint of P. Pihelgas, then the possible participation of P. Pihelgas himself in the described experiment cannot violate his right to vote. Namely, a person with the right to choose a voting method has, by infecting his or her computer with a virus blocking the transmission of “a vote unsuitable for the virus”, put him- or herself knowingly in a position where the electronic vote cast by him or her will not be delivered to the National Electoral Committee.

19. It can be concluded from the memorandum and the complaint of P. Pihelgas that P. Pihelgas deems it possible that a similar virus can be in the computer of the voter without his or her awareness. Such a hypothetical possibility cannot be a justification for satisfaction of the complaint of P. Pihelgas even if he voted electronically via his computer which did not contain a vote blocking virus to his knowledge. A prerequisite for declaring the voting results invalid is an established violation of the voter's rights.

20. Due to the abovementioned reasons, the complaint of P. Pihelgas is dismissed.