After the recent municipal election I met with Dean Smith, President of Intelivote Systems Inc. of Dartmouth, the company behind the online voting engine. I was looking for some good lessons that I could relate to business situations, such as insights on data security and system integrity, but I quickly came to realize this story is more about business processes and procedures than about technology.
Smith and his team spent a year setting up the election using their configurable system, making custom changes to handle unique situations, running proofs of concepts, testing over and over again, and even suggesting legislation changes to permit online voting.
Here is how the system works: The electoral list – the list of people eligible to vote– is “scrubbed” to remove duplicates and people who have moved away and a series of “Personal Identification Numbers” – PINs – are randomly generated and assigned to people on the resultant list. Everyone on the list is then mailed a card to use for voting either electronically or manually.
The Intelivote system matches the PINs to the list of candidates applicable to each voter. When the system is activated, people can either go online or use a touch-tone telephone to vote. Once a PIN is verified, and in this case coupled with a birthdate verification, the person is allowed to vote. The vote is recorded and the person is identified as having voted. No record is kept as to who each individual has voted for, nor is a public tally of votes kept anywhere.
The system runs on ten computers at a secure data centre in Halifax, connected to the Internet via a high-speed network. At its busiest point, the system was only 8% taxed. Even if voter turnout had been high, it still would have not broken a sweat. (Not so, perhaps, for some of the candidates.)
The system and procedures are highly auditable, and a third party – in this case Ernst & Young – oversees the entire process. These auditors perform a prescribed series of procedures to validate activities; i.e. each PIN is unique and used only once, the system is accessible during approved times and not accessible otherwise, the system is capable of receiving votes for every candidate, hackers are kept out, etc.
Intelivote provided 24 x 7 technical support during the e-voting window. When the window closed, the data was removed from the server, encrypted, and given to the Chief Electoral Officer. The encrypted data required three security keys to decrypt – one with the Chief Electoral Officer, one with the auditors, and one with Intelivote. As well, a paper backup was made and kept in a sealed envelope by the Chief Electoral Officer. A new paper version of the electoral list was created for the polling booths, showing who had already voted electronically.
Smith points out that any problems that have been reported were due to list management issues, not the system, and would have happened in any event.
Nova Scotia’s first attempt at electronic voting was in 1992. That system was incapable of handling the traffic and the leadership convention it was serving had to be cancelled. Kudos to Dean Smith for recognizing that it failed not because it was a bad idea, but because it was not implemented properly. Now Smith’s systems are used throughout the country and overseas.
Cathy Mellett, Project Director for E-voting at HRM says they put out a world-wide tender for this contract. “We find it very satisfying to find the best in the world in our own back yard,” she said in a recent phone interview.
The bottom line: IT projects succeed not just because of good technology but also because of proper adherence to business processes and procedures. Smith, his team at Intelivote, and his customer at HRM know this full well and stepped up to the challenge.
