Estonia’s internet voting: twenty years of binding i-votes, re-voting and the security debate

Estonian internet voting, called i-voting, lets every eligible voter cast a binding ballot online during an advance voting period using a state electronic identity, and Estonia has used it in elections since 2005.⁠¹ In the March 2023 parliamentary election, 313,514 people voted online, 51.1% of all participating voters, and ODIHR reported it as the first parliamentary election in which internet votes exceeded those cast in polling stations.⁠^2,4 Election observers from the OSCE have found the process professionally run and generally trusted, while security researchers, observers and several opposition parties have pointed to gaps in verification, insider risk and coercion that remain debated.⁠^4,6,7

Internet voting is not covered in the comparative overview at /research/cases/. For the broader security questions see /trust/security/ and /trust/audits-and-verification/.

What happened

Estonian i-voting grew from a small local trial into the most used channel in national elections. The dated record below is drawn from the State Electoral Office, OSCE/ODIHR reports and research verified for this page.

• 2005. Electronic voting with binding results began, and Estonia describes itself as the first country to use i-voting in national elections.⁠¹ In the 2005 local elections, 9,317 people voted online, 1.9% of participating voters.⁠² The same year the Supreme Court issued judgment No 3-4-1-13-05 on equal treatment in i-voting.⁠¹
• 2007. In the parliamentary election, 30,275 people voted online, 5.5% of participants, over a three-day window.⁠²
• July 2013. The source code of the i-voting system software was made public, according to the State Electoral Office.⁠³
• November 2014. Springall and colleagues published a security analysis at the ACM Conference on Computer and Communications Security finding “serious architectural limitations and procedural gaps”.⁠⁷
• September 2017. Researchers reported a flaw in a widely used RSA key generation library (later named ROCA), and Estonian authorities said about 750,000 ID cards issued after October 17, 2014 were potentially affected, weeks before local elections with online voting.⁠^9,10
• March 2019. Parliamentary election. ODIHR found that individual vote verification had been introduced but that the system was “not software independent”.⁠⁵ The Supreme Court rejected two post-election appeals while calling for clearer legal rules.⁠⁵
• 2021. Voters gained the right to override an i-vote with a paper ballot on election day itself.⁠¹
• March 2023. Parliamentary election: 51.1% of participants voted online.⁠² One party alleged fraud through internet voting, and its complaints were dismissed by the National Electoral Committee.⁠⁴
• May 24, 2024. Parliament amended the Riigikogu Election Act to bring internet voting rules into line with Supreme Court judgments of 2019 and 2023.⁠⁶
• January 2025. The National Electoral Committee allowed voters to identify with Smart-ID.⁠^6,3
• June 2025. ODIHR issued an opinion on Estonia’s internet voting law at the request of the Second Vice-President of the Riigikogu.⁠⁶

How it worked

Estonian i-voting is a remote channel added to paper voting, not a replacement for it. Its legal and technical design, as described by the State Electoral Office and ODIHR, works as follows.

Legal basis

The State Electoral Office cites Section 60 of the Constitution, which requires free, general, uniform and direct elections with secret voting, and the 2005 Supreme Court judgment on equal treatment.⁠¹ Detailed rules sit in the Riigikogu Election Act, which the 2024 amendments expanded with provisions on general principles, the electronic voting procedure, secrecy and security.⁠⁶ In a 2023 judgment quoted by ODIHR, the Supreme Court held that the legislature must “provide for sufficiently tight regulation in the electoral laws on all important issues concerning elections”.⁠⁶

Identity

A voter must authenticate with an ID card, Mobile-ID, Smart-ID or another digital identity document with valid certificates and PIN codes.⁠¹ Smart-ID has been accepted since 2025.⁠³ Identity is not a separate registration step: the voter register is extracted from the Population Register and kept up to date, including for internet voting.⁠⁴ See /trust/identity-and-registration/.

Timing

“Electronic voting starts on the Monday of the election week at 9 a.m. and ends on Saturday evening at 8 p.m.”.⁠¹ In 2023 it ran from February 27 to March 4, the night before the March 5 election day.⁠⁴ In 2007 the window was three days.⁠²

Re-voting and paper override

The central anti-coercion device is re-voting. “During i-voting, a voter can always vote again and change their vote as many times as they wish,” and only the last i-vote counts.⁠¹ “If a voter has voted both electronically and by using a paper ballot, only the vote cast at the polling station will count”.⁠¹ ODIHR describes the purpose: the method “is aimed at increasing opportunities for voters to vote in private and, therefore, in secret”.⁠⁴ In its 2025 opinion ODIHR summarized the legal logic: the challenge to secrecy is addressed “by allowing voters to change or override their vote online” or on paper.⁠⁶

Encryption, counting and verification

ODIHR describes a “double envelope scheme”: the inner envelope holds the vote encrypted with a public election key, and the outer one carries the voter’s digital signature.⁠⁴ Only members of the National Electoral Committee hold the decryption key, and access is divided among them.⁠¹ After voting closes, superseded votes are removed, remaining votes are anonymized, shuffled and decrypted on a computer not connected to any network, and an independent auditor can check the shuffle and decryption.⁠⁴

Voters can check their own vote with a smartphone app by scanning a QR code. The State Electoral Office says “the vote can be checked during 15 minutes up to three times”,⁠³ while ODIHR’s 2023 report gives a 30-minute window.⁠⁴ The two official accounts differ, and the difference was not resolved for this page.

Who runs it

The State Electoral Office configures and operates the system and organizes decryption; the State Information Authority (RIA) hosts it, responds to cyberattacks and runs penetration tests; the National Electoral Committee supervises and handles complaints.⁠⁴ The 2023 software was developed by Cybernetica AS, a private company that won a public competition.⁠⁴

Measured results

Estonia publishes detailed i-voting statistics by election. The table below reproduces the State Electoral Office figures; the denominator for the i-vote share is all participating voters.⁠²

Three features of the data matter for interpretation.

• Turnout did not rise with i-voting. Parliamentary turnout was 61.9% in 2007 and 63.5% in 2023, while the online share rose from 5.5% to 51.1%.⁠² On these figures, i-voting mostly shifted voters between channels. That is a descriptive observation, not a causal estimate.
• Few voters verify, and few override. In 2023, 5.5% of i-votes were verified by the voter, and 1,332 i-votes were cancelled because the voter also voted on paper.⁠² ODIHR reported 1,329 electronic votes removed;⁠⁴ the small difference between the two official counts was not explained in the sources.
• Use spans ages. In 2023 there were 22,751 i-voters aged over 75 and 24,569 aged 18 to 24.⁠² Of 966,129 eligible voters, 32.5% voted online.⁠²

ODIHR’s 2023 report records that 312,181 votes were cast over the internet and 301,620 in polling stations or by home voting.⁠⁴ It also found that 63 voters initially voted for lists in their previous districts because the system began with an outdated voter register; 59 voted again online, and the ballots of four who did not were revoked.⁠⁴

Failures and criticisms

Criticism of Estonian i-voting comes from security researchers, international observers and domestic parties, and the strongest versions differ.

• Architecture. Springall, Finkenauer, Durumeric, Kitcat, Hursti, MacAlpine and Halderman, after observation, code review and adversarial testing, reported that “the I-voting system has serious architectural limitations and procedural gaps,” and demonstrated in a lab reproduction how attackers could target servers or voters’ computers.⁠⁷ Their project site states: “We urgently recommend that Estonia discontinue use of the system”.⁠⁸ Estonia continued, and later versions added verification.⁠⁵
• Software independence and insider risk. ODIHR in 2019 found the system “not software independent, meaning that software errors in its components may cause undetected errors” and noted source code updates three days before election day.⁠⁵ In 2023 it found that the step removing overwritten votes “was not audited,” and warned that an insider able to alter the system undetected “could manage to control which votes are removed”.⁠⁴
• Verification design. ODIHR in 2023 described a known attack in which an altered voting app could make the verification app display the voter’s original choice while a different vote was submitted, calling this “a critical deficiency in the current design of the voter verification step,” while judging it difficult to deploy at scale undetected.⁠⁴ It also found that a technically skilled voter could submit an improperly formed ballot; one invalid vote was detected and discarded.⁠⁴
• Identity infrastructure. The 2017 ROCA flaw showed that the voting system inherits the security of the national ID card. The researchers estimated factoring a 2048-bit key at roughly $20,000 to $40,000 in computing cost.⁠⁹ Minister Urve Palo said in September 2017 that the risk was “great enough to take seriously, but not enough to cancel the cards,” and that the State Electoral Office would decide on use of affected cards in that autumn’s online voting.⁠¹⁰
• Coercion. Re-voting assumes a coerced voter can later vote again in private. Isamaa representatives told ODIHR they were concerned about coercion “especially in care homes” and claimed it had become more sophisticated in local elections; Isamaa and the Centre Party proposed face recognition.⁠⁶ ODIHR recommended a legal duty to monitor for group voting on shared devices and to audit after elections.⁠⁶
• Partisan split in trust. ODIHR in 2023 found “a generally high level of public trust” but “notable divisions” between those who fully trust and fully distrust i-voting.⁠⁴ Paper-only preliminary results showed EKRE at 24.9% and Reform at 20.3%; final results including i-votes gave Reform 31.2% and EKRE 16.1%.⁠⁴ ODIHR reported that some EKRE leaders said the election was “stolen through internet voting,” that the claims were unsubstantiated, and that complaints were dismissed.⁠⁴ EKRE’s position, as reported by ODIHR in 2025, is that i-voting in national elections should be suspended until end-to-end verifiability is implemented.⁠⁶ A poll commissioned by EKRE in April 2023 found 38% of respondents did not consider e-voting reliable.⁠⁶ The Reform Party, Social Democrats and Estonia 200 support the current system, citing trust in the institutions, a 2022 audit and the re-voting remedy.⁠⁶
• Process legitimacy of the 2024 law. ODIHR noted that the 2024 amendments “were approved by the ruling majority without opposition support” and that consultation lacked discussion of how electoral principles apply to internet voting.⁠⁶
• Communication. In 2023 decryption finished several hours after paper results were public, and ODIHR found the unexplained delay hurt confidence.⁠⁴

What transferred and what did not

Estonia’s model has been watched more than copied. The verified comparison for this page is Switzerland, where the Federal Chancellery states that since 2004, “15 cantons have offered internet voting to a limited part of their electorate in over 300 trials,” that e-voting “is only permitted if strict requirements under federal law are met,” and that licenses cover only “a limited section of the electorate”.⁠¹¹ Switzerland kept internet voting as a bounded trial; see /cases/switzerland-direct-democracy/.

The component that transferred least is the foundation: Estonia’s i-voting depends on a mandatory state electronic identity and a continuously updated population register.⁠^1,4 Supporters cited by ODIHR point to Estonia’s “unique approach to the use of electronic IDs” as a source of confidence.⁠⁶ Countries without that identity layer cannot copy the voting system alone. Within Estonia, extension continues: the 2024 law allows the National Electoral Committee to decide on voting from mobile devices and on alternative e-identification.⁠⁶

Lessons for My Vote Forward

The following points are interpretation and design proposals, not findings about My Vote Forward, which has not been tested.

• Remote secrecy is a design claim, not a property of software. Re-voting is Estonia’s answer to coercion, and opponents still report care-home concerns.⁠⁶ My Vote Forward keeps public opinion separate from any private vote for this reason; see private voting and intimidation.
• Publish the denominator and the channel split. Estonia’s statistics let anyone see that online share grew while turnout did not.⁠² Any release should show who participated through which channel; see measurement.
• Verification must cover every step that changes the count. ODIHR’s finding that vote removal was not audited;⁠⁴ is a reminder to list every transformation of data and who checks it; see audits and verification.
• Identity is the hidden dependency. ROCA⁠⁹ shows that a participation system inherits the weaknesses of whatever identity it relies on; see hardware.
• Trust can split by party even when observers find no fraud. Plan to explain timing and process before results arrive⁠⁴ see published releases.
• Rules belong in law, not only in configuration. The Supreme Court’s demand for “sufficiently tight regulation”,⁠⁶ parallels the need for public, versioned rules in any framework; see governance.

Unresolved questions

• How were ROCA-affected ID cards handled for the October 2017 local elections, and how were certificates updated? The State Electoral Office decision was not verified for this page.
• Which is correct for the verification window, 15 minutes⁠³ or 30 minutes⁠⁴ and did it change between elections?
• How much coercion occurs in care homes or shared-device settings? Allegations are reported,⁠⁶ but no measured prevalence was found.
• Has Estonia adopted end-to-end verifiability or audited the vote removal step since ODIHR’s 2023 recommendation⁠⁴?
• Does i-voting change who votes, or only how they vote? The official figures⁠² do not answer this causally, and no peer-reviewed causal study was verified for this page.
• The consolidated English text of the Riigikogu Election Act could not be retrieved for this page, so section numbers are cited through ODIHR’s opinion⁠⁶ rather than the statute directly.