The Conservative party should not use online voting to pick its leader and next prime minister, cybersecurity experts have warned, as the technology is not proven for such a “high stakes” use.
For the first time, the next UK prime minister will be selected by online voters, as well as those sending paper ballots. The 160,000 Conservative party members who have a vote were offered the choice of filling in their postal ballots and returning them, or of voting online instead, using a code contained on the form.
It is only the second time in history such a small number of party members have been in a position to directly decide who will be the UK leader. In an effort to ease the count, the party “recommends” members vote online where possible.
But Peter Ryan, a professor of applied security at the University of Luxembourg, was among those warning the technology was not ready. “We do not have the technology to conduct voting securely online and so it should not be deployed for high-stakes elections,” Ryan told the Wall Street Journal. “And I count this as rather high stakes … For the moment, short of a major conceptual breakthrough, I don’t see how it can be done.”
The decision to offer members an online vote received technical support from the UK’s National Cyber Security Centre (NCSC), which intervened in early August to delay the posting of ballots. An email received by party members earlier this month said: “Your ballot is now on the way – but it will arrive with you a little later than we originally said. Please do not worry. This is because we have taken some time to add some additional security to our ballot process, which has delayed us slightly.”
The NCSC, a branch of GCHQ, said: “We work closely with all parliamentary political parties, local authorities and MPs to provide cybersecurity guidance and support.
“As you would expect from the UK’s national cybersecurity authority we provided advice to the Conservative party on security considerations for online leadership voting.”
Online voting is regularly criticised by security experts because of the lack of any physical paper trail. In contrast to in-person electronic voting, where voters can be issued with a receipt to demonstrate how their vote was recorded and where paper records can be checked after the fact, a purely online vote leaves no record other than the electronic database of how many votes were recorded for each candidate.
The option to vote online was planned in the 2019 Conservative leadership election but not implemented, and Boris Johnson was elected with 92,000 paper votes versus Jeremy Hunt’s 47,000.
