Estonian online voting system source code is on GitHub for public review
The valimised/ivxv repository on GitHub holds the source code of the Estonian online voting system. According to its README, the purpose is to make that code available for public review.
The README makes a specific promise about the contents. The repository is not used for active development, but it will be kept up to date, so the code that can be found there is the code that is used for elections.
It also explains who steers the work. Because a voting system used for legally binding elections must strictly follow the legislation, the actual development of the Estonian I-voting system and the I-vote verification application is supervised by the State Electoral Office of Estonia. For further information, readers are pointed to www.valimised.ee.
That is the whole of the page: a short statement of intent, a rule about keeping the code current, a note on legal oversight and a pointer to the official site. The text gives no release date, no licence, no named developer and no description of the system's architecture or technology.
Key facts
- The valimised/ivxv GitHub repository publishes the source code of the Estonian online voting system for public review.
- The README says the repository is not used for active development but will be kept up to date, so the code there is the code used for elections.
- The README says development of the Estonian I-voting system and the I-vote verification application is supervised by the State Electoral Office of Estonia.
- Readers are directed to www.valimised.ee for further information.
Why it matters
A voting system used for legally binding elections must strictly follow the legislation, as the README puts it. Putting the code in public view lets anyone check the implementation against that standard. The README's promise that the repository matches the code used for elections is what gives the publication weight: reviewers would be looking at the real system, not a demo.
Who it affects
The README addresses anyone who wants to review the code. It also names the State Electoral Office of Estonia as the body that supervises development of the I-voting system and the I-vote verification application. The text does not say who the reviewers are or how many voters use the system.
How to use it
Open the valimised/ivxv repository on GitHub to read the code. The README sends readers to www.valimised.ee for further information. The repository is for review, not for active development, so it is not a place to look for a development roadmap. The README states no licence.
How solid is it
The claims come from the repository's own README, so this is a first-party statement of intent. The README says the repository will be kept up to date so that it matches the code used for elections. The text gives no date of publication or last update, and it mentions no results of any security review or audit.
Risks and caveats
The assurance that the published code is the code used for elections rests on the README's statement; the text offers no mechanism for checking it. The page mentions no audit results, so publication alone says nothing about how well the system has been examined. It also describes no programming language, architecture or technical detail, and names no developer or contractor.
“The intention behind this repository is to make source code of the Estonian online voting system available for public review.”
— Repository README, valimised/ivxv