meduza

Stop the steal, rock the vote Meduza explains the debate about the legitimacy of Moscow’s online elections

Source: Meduza

Moscow’s Public Election Monitoring Committee is auditing the results of local remote electronic voting (DEG) during Russia’s recent State Duma elections. The review (not to be confused with a formal recount that carries legal weight) is a rare response to fraud allegations from opposition candidates who lost narrowly after electronic votes were added to the final results. The monitoring committee has defended the elections’ legitimacy and hopes an audit will raise confidence in electronic voting, which federal officials plan to expand in future elections. The effort, however, is unlikely to persuade opposition politicians and experts in blockchain technology (which is the basis for Russia’s DEG system) who say online voting is a “black box” that the authorities’ control completely. Since the polls closed in Moscow, mathematicians, political scientists, and economists have debated the merits of election fraud allegations. Meduza breaks down these arguments.

Russia offered electronic voting in Moscow and six other regions: Nizhny Novgorod, Murmansk, Rostov, Kursk, Yaroslavl, and Sevastopol

In the six regions outside the capital where electronic ballots were available, the telephone provider Rostelecom was responsible for running the online system. In Moscow, however, this task fell to Mayor Sobyanin’s Information Technology Department and the Public Election Monitoring Committee, headed by Ekho Moskvy editor-in-chief Alexey Venediktov. Kaspersky Lab, a cybersecurity company with close ties to the Russian authorities, was directly involved in designing Moscow’s DEG platform.

Outside the capital, relatively few voters experimented with the new electronic option, but nearly half of Moscow’s electorate (about 2 million people) cast their ballots online.

When the dust settled, the candidates backed by United Russia or the Kremlin won every single race where electronic voting was available. In most of these contests (with the exception of elections in Yaroslavl), they won by comfortable margins both offline and online. Voting in Moscow was different, however. Eight of the candidates with Mayor Sobyanin’s endorsement would have lost their races without electronic votes.

The same phenomenon repeated in Moscow’s proportional-representation voting: Russia’s Communist Party (KPRF) narrowly bested United Russia in paper ballots, but the ruling party collected roughly 450,000 more electronic votes, catapulting it ahead of KPRF. Thanks to these online votes, United Russia finished a whole 14 percentage points higher than the Communists, when all the counting was done.

The other thing that separates Moscow’s electronic voting from what was offered in other regions is that Muscovites were given the chance to change their votes several times before the end of the elections. The “revoting” option was designed to prevent employers from being able to pressure staff to vote (under their supervision) for particular candidates. (This way, anyone forced to vote a certain way at work could change that vote, later on, in private. Only the last ballot cast actually counted.) This was the first time Russia ever allowed voters to recast their ballots.

According to Alexey Venediktov, 300,000 Muscovites utilized the revoting option, and many of these people changed their votes more than once. In total, the city’s online elections system processed more than 650,000 revoting “transactions,” but election observers cannot access these data. Instead, Moscow’s election commission released only aggregate numbers, meaning that revotes were somehow already factored into the final tally.

So who counted Moscow’s “revotes”?

Nobody really knows. The developers behind DEG have explained many times how the system works, though important technical details (for example, how the final tally is calculated) remain a mystery. Developers discussed and described one system but used a completely different, ultimately unknown procedure to count all the electronic ballots.

A more detailed explanation

The original design of Moscow’s electronic voting platform complicated the introduction of revoting. If developers had centralized the platform and actually identified users in the system’s data, they could have enabled revoting simply by updating a single value for any users who changed their votes. To protect votes’ secrecy, however, developers had to separate the processes for issuing and counting ballots by resorting to blockchain technology (using decentralized data storage spread over a network of participants, often referred to as “nodes”). DEG’s architecture assigns one part of its system the tasks of identifying users and issuing ballots, while a separate part of the system actually registers and counts votes. This division of labor is meant to make it impossible to link the identity of anyone who received a ballot to how that ballot was counted.

To add revoting to this system while preserving ballot secrecy, developers had to add modifications that allowed the platform to throw out all but an individual’s final vote. 

Independent observers still don’t know how these modifications were designed, though it’s clear that the number of votes recorded in the “old,” main part of the system differs significantly from the results published by Russia’s automated State Information System. We do not know who these additional ballots were for.

All the records of the voting process were stored in the blockchain, to which election observers lacked direct access (except through special restricted computers installed at monitoring points). To watch the blockchain’s data being uploaded, monitors could use a special “observer” website that the Moscow Mayor’s Information Technology Department controlled. Observers say the two different systems reported different data during the elections, however, which could have been due to a delay or to disruptions in the “observer” website’s functionality.

Speaking to the radio station Ekho Moskvy on September 21, Artem Kostyrko, who chairs Moscow’s electronic voting developers’ group, promised to release examples of revoting chains and details about the mechanics that guide how these votes are counted. 

An even more technical explanation

In a post on Habr, Pyotr Zhizhin has broken down all the technical details about what is missing from Moscow’s elections data. To try to understand how the electronic voting occurred, Zhizhin downloaded the entire sql (Structured Query Language) archive that was available at Moscow’s blockchain observer website and analyzed its contents.

Using a PostgreSQL database management system, the electronic voting data is arranged into three columns that include decrypted ballots and transactions. Among a dozen kinds of transactions are issuances, receipts, ballot decryptions, and completed votes. Zhizhin also found that transaction data show user IDs only for transactions when ballots were issued, not when ballots were received. Transactions for ballots received don’t even contain a voter’s district number — just an encrypted record of the vote’s result, a public encryption key, and a cryptographic nonce (an arbitrary number that can be used just once in a cryptographic communication).

Zhizhin could find no traces of revotes in the database. In fact, even using the saved hashes for one voter’s two revotes, he was unable to find any transactions linked to a single electronic ballot. This is perfectly consistent with the blockchain structure’s anonymity, but it raises a serious concern: If the public part of the system can’t isolate revotes, it means it’s also incapable of counting the elections’ final vote tally. In other words, we don’t know how election officials actually counted all the electronic votes.

When examining the sql archive, moreover, it becomes clear that more than a third of the encrypted ballots aren’t decrypted at all, and transactions 10 and 11 in the blockchain (at the conclusion of the voting process) weren’t ever recorded.

At the same time, Moscow’s DEG system registered significantly more votes in each district than it issued to voters: the city issued a total of 1,943,590 electronic ballots to voters but received 2,021,969. Both the information available at the official observer website and Zhizhin’s own analysis (the combined numbers of ballots issued and received) confirm these figures.

Based on these findings, Pyotr Zhizhin reached the following conclusions:

Okay, so remote electronic voting has its drawbacks, but is there any direct evidence of fraud?

There’s no direct evidence. Opposition candidates say votes were falsified in the part of the DEG system that is inaccessible to outside observers:

Those who support the authorities and defend the legitimacy of Moscow’s electronic voting and United Russia’s victory have offered the following arguments:

In both these cases, the effect on electronic ballot totals would resemble voter fraud: the mobilization of United Russia’s supporters would have the same impact as ballot stuffing, and the demobilization of the opposition’s voters would look similar to ballot changing. 

As Tatiana Mikhailova and other economists have noted, however, outside observers can still catch some differences between outright fraud and the mobilization or demobilization of voters. This detection requires understanding the various results that parties and candidates would likely get given different levels of fraud and mobilization.

If the authorities’ candidates benefitted from electronic voter mobilization

Whatever the legality of how Muscovites were mobilized, flooding the city’s DEG system with votes for the candidates backed by United Russia and Mayor Sobyanin would have raised these candidates’ shares of electronic votes relative to in-person voting, but it also would have proportionally lowered the shares of online votes received by all other parties’ candidates. 

If mobilization explains the results, opponents’ share of electronic votes should have declined the most in the districts where the online mobilization of the authorities’ supporters was greatest. In Moscow, the city’s eastern and southeastern districts have the most resources to manage such mobilization. Traditionally, the authorities’ candidates perform much better in these areas of the capital than in the southwest, west, and north sides.

If the authorities’ candidates won thanks to ballot stuffing

Ballot stuffing would also inflate the share of electronic votes won by the authorities’ candidates and suppress opponents’ online vote shares, but the shifts would be more dramatic where more fraud was necessary (namely, in Moscow’s more traditionally opposition-leaning districts, like in the city’s southwest). 

If the authorities successfully mobilized their supporters to vote electronically and the opposition succeeded in demobilizing such voting

Under these circumstances (which certainly existed in reality), the authorities’ candidates would have won higher shares of electronic votes than paper ballots, and the opposition groups that urged supporters to vote in person (such as the Communist Party and Yabloko) would have won smaller shares of online votes.

The shares of electronic votes for other parties and their “neutral” candidates, meanwhile, would vary from district to district, depending on the support levels for the authorities and the opposition.

Where the authorities have more supporters, they would be able to mobilize more electronic voting, boosting their candidates’ online vote shares to a greater degree than the opposition’s demobilization diminishes its candidates’ shares of electronic voting, ultimately lowering the share of votes for “neutral” candidates relative to paper ballots.

In the districts where the opposition’s support is stronger, we would see the reverse effect: the opposition’s online voter demobilization would reduce its share of electronic votes in these areas more sharply than the authorities could raise their returns by mobilizing supporters, resulting in neutral candidates winning higher shares of electronic votes than with in-person voting.

Where the authorities and the opposition typically enjoy equal levels of public support, the mobilization and demobilization effects would largely counterbalance and “neutral” candidates’ share of online voting would be roughly the same as observed in paper ballots. 

In other words, if the authorities successfully mobilized online voting and the opposition successfully demobilized online voting, the candidates endorsed by United Russia and Mayor Sobyanin would have won higher percentages of electronic ballots in the districts most loyal to the authorities, while the opposition’s share of online votes should have fallen to its lowest levels in the districts where opposition sentiment is strongest. Candidates outside these two camps would have performed differently online in different districts across the city.

If votes for the Communist Party’s candidates were reassigned to United Russia’s candidates

The expected effects of reassigned votes would vaguely resemble the combination of mobilization and demobilization described above. The main difference is that votes taken from opposition candidates and “given” to United Russia’s candidates would have left the two groups’ aggregate share of electronic voting unchanged. If these “transfers” occurred in all 15 districts across the city, “neutral” candidates’ share of the electronic vote would be consistent, as well.

So what actually happened?

The graph above depicts how much more or less United Russia (orange), the Communist Party (blue), and all other parties combined (gray) won in electronic voting across Moscow, relative to voting with paper ballots. Clearly, the “other” parties’ performance was generally the same across all districts. Meanwhile, United Russia’s share of online votes was highest not where the party typically enjoys the most support (in Moscow’s eastern and southeastern districts), but in the traditionally opposition-leaning areas, where anyone theoretically trying to falsify the election results in the authorities’ favor would have needed to commit extensive fraud.

These results most closely resemble what would happen if Moscow election officials reassigned votes for KPRF to United Russia in districts across the city, though the debate about this interpretation is ongoing. For example, statistician Boris Ovchinnikov has argued that natural differences in voter preferences might partially explain the patterns in online and offline voting. Journalist Mikhail Zelenskiy, meanwhile, believes that Moscow’s electronic voting resembled a single polling station mobbed by public servants mobilized to vote for United Russia. 

But accusing Moscow election workers of “reassigning” votes fails to explain why similar patterns emerged in three of the six regions (Murmansk, Yaroslavl, and Rostov) that also offered online ballots but no revoting option. United Russia’s share of the electronic votes was relatively higher, KPRF’s share dropped, and other parties performed roughly the same offline and online. (Of course, as some have pointed out, electronic voting outside Moscow suffered from other technical vulnerabilities.)

In the three remaining regions that conducted electronic voting, the effects of the authorities’ mobilization and the opposition’s demobilization were evident.

That’s a lot of fine-and-dandy data science, but is there anything more concrete that indicates fraud?

Others have interrogated the election data and found signs of fraud, but the evidence is still circumstantial and ultimately ambiguous. Observers, experts, and campaign workers for the losing opposition candidates have studied the partial electronic voting records released to the public in accordance with the law: anonymized data about when votes were cast and for whom (without any indication of which votes were revotes). 

For example, Anastasia Bryukhanova (an independent who ran in Moscow’s 198th district with Smart Vote’s endorsement) defeated Galina Khovanskaya, Mayor Sobyanin’s candidate, by less than two percentage points in offline ballots, but Khovanskaya crushed her in electronic voting by a margin of 13 percent, and Bryukhanova lost the election. 

Using data from the publicly accessible part of Moscow’s DEG system, Bryukhanova’s team tracked how Khovanskaya jumped to an early lead in electronic voting on Friday morning (like all the authorities’ winning candidates). In theory, this could be the result of the authorities “mobilizing” voters at their places of work.

Khovanskaya’s online lead slowed on Saturday but exploded to new heights on Sunday morning. The authorities’ candidates in other districts enjoyed the same late burst of electronic support. The voting dynamics during these hours (in this case, the difference in the percentage of votes for the authorities’ candidates and their closest competitors in the opposition) repeated almost exactly across all 15 districts in Moscow.

Just around lunchtime on Sunday, the percentage of ballots cast for the authorities’ candidates mysteriously dropped to what opposition candidates were getting. After an hour, the influx of votes for United Russia resumed before it slowed again for good in the elections’ final hours, when Bryukhanova briefly won more electronic votes.

This kind of synchronized voting across the entire city resembles neither an organic expression of popular will nor the mobilization of the authorities’ supporters based on some set of instructions. Bryukhanova’s campaign argues that the best explanation is centralized online ballot stuffing in favor of Khovanskaya and the authorities’ other preferred candidates.

It should be noted, however, that any manipulation of the ballots submitted on Sunday did not by itself provide candidates with a decisive advantage, given that the ballots at this stage, in absolute numbers, were just a few thousand. That said, if any fraud is confirmed, it would constitute sufficient legal grounds to invalidate all votes submitted to that online polling station. 

Meanwhile, the officials who organized Moscow’s DEG system have denied all fraud allegations. In an attempt to debunk criticisms, Public Election Monitoring Committee head Alexey Venediktov shared a graph of electronic voting results in Moscow’s 198th district (where Bryukhanova ran) drawing on data not available to the public that includes revotes.

The graph shows, hour by hour, how many online ballots each candidate in the 198th district won, as well as how many additional ballots each candidate lost in “revotes” (in ballots reassigned to other candidates after voters changed their minds). 

Venediktov’s graph shows a sizable group of voters who initially cast online ballots for Galina Khovanskaya but later changed their votes. This is exactly what was expected with revoting, which was designed to protect people from being pressured to vote for certain candidates by their employers. On Saturday evening, however, Moscow’s DEG system registered hundreds of votes for Bryukhanova that were later reassigned to other candidates (the graph makes it impossible to know which). Another burst of revotes appeared on Sunday morning. These spikes occurred at no other time in the 198th district’s voting.

Economist Tatiana Mikhailova argues that it’s unclear why large groups of voters would cast ballots for independent candidate Bryukhanova on Saturday evening and Sunday morning and later change their opinion. The unusual pattern, she says, looks more like someone with administrative access to Moscow’s voting system simply reassigned these ballots to another candidate.

Venediktov’s monitoring committee later published analogous graphs depicting electronic voting results in Moscow’s 14 other districts. In each image, we find the same pattern: sizable groups of voters cast ballots for opposition candidates on Saturday evening and later change their votes to other candidates. This pattern appears in party-list electronic voting for KPRF, as well. Admittedly, the scale of this revoting is not enough to explain all the anomalies found in the DEG’s final results.

Despite all this, there’s little chance of proving fraud and invalidating Moscow’s electronic voting results

The organizers behind Moscow’s remote electronic voting system clearly do not intend to release all the information about votes recorded during the elections. The graphs published by Venediktov’s committee convey just a fraction of the raw electronic data generated during the city’s online voting. Election officials say the reason for this lack of transparency is simply that these data “do not display publicly.” At the same time, the authorities will likely dismiss any circumstantial evidence of fraud (no matter how incriminating it might be).

Whatever happened in the cyberspace between Moscow’s online ballots, we have learned definitively that this particular approach to electronic voting fundamentally lacks the following:

These problems are likely solvable in theory, but it’s unlikely that any fixes are possible in Russia today.

Grigory Golosov, who chairs the European University at St. Petersburg’s political science department, wrote the following plea, a day after the elections: