Norway’s internet voting trials: 2011 and 2013

Norway’s internet voting trials let voters in 10 municipalities in the September 2011 local elections and 12 municipalities in the September 2013 parliamentary election cast ballots online during the advance voting period, with unlimited revoting and SMS return codes for verification.⁠^1,2 In 2013, 70,090 voters cast their counted vote online, about 36 percent of votes received in the trial municipalities; the government then decided not to continue the trials, and a parliamentary committee concluded in 2015 that internet voting as a general alternative to advance and election day voting is, in this site’s translation, “for the time being not achievable”.⁠³

In plain words

Norway is a country where most people trust their elections. Its government wanted to see whether letting people vote over the internet would make voting easier and maybe bring more people to the polls. So it tried it, in a few towns, twice.

The system had two clever protections. First, you could vote online as many times as you wanted, and only your last vote counted. If someone stood over your shoulder and made you vote their way, you could vote again later in private. A paper vote at a polling place canceled any online vote. Second, after you voted, you got a text message with a short code. You could check that code against a printed card mailed to you, to see that your computer had sent the vote you chose.

It mostly worked. But in 2013 a programming mistake made some votes less well protected than they should have been. Turnout did not go up. And many lawmakers kept worrying that nobody could guarantee a person voting at home was really voting alone. In 2014 the government stopped the trials.

Defined terms

• Advance voting. Voting before election day. In Norway’s 2013 trial, internet voting was available only during the advance period, from August 12 to September 6, 2013, not on election day.⁠³
• Revoting (vote updating). Allowing a voter to cast more than one ballot, with only the final one counted. Norway used it “to mitigate the risk of voter coercion or vote buying”.⁠¹ See intimidation.
• Return code. A short code, unique to each voter and each party, printed on a polling card mailed to the voter. After an online vote, the system sends the matching code by SMS so the voter can check that the vote was received as intended.⁠¹
• Cast as intended. The property that the ballot recorded by the system matches what the voter meant to choose, even if the voter’s computer is infected.
• Electronic ballot box. The server that stores encrypted online votes until counting.
• Internet Election Committee (IEC). A nine member oversight body created by regulation in June 2013 to hold keys, supervise the system, and verify decryption.⁠¹

What happened

Norway’s 2011 pilot made internet voting an “additional voting channel for voters registered in ten selected municipalities” for the September 12, 2011 local elections.⁠² The OSCE Office for Democratic Institutions and Human Rights (ODIHR), invited by the government, reported that the ministry ran the pilot “impartially and professionally” and ensured “a high level of security,” while noting technical difficulties and that many procedures were never formalized.⁠² According to the ODIHR’s 2013 report, 17 percent of voters registered in the 2011 pilot municipalities voted over the internet.⁠¹

The 2013 continuation was contested. The parliament decided in April 2013 “by a narrow margin” to continue the pilot, after what ODIHR called “heated discussions” over “the secrecy of the vote when voting from uncontrolled environments”.⁠¹ The late decision, ODIHR found, “limited the time to develop and test the system”.⁠¹ Twelve municipalities took part, ten from 2011 plus Fredrikstad and Larvik, raising the eligible population from about 168,000 in 2011 to about 250,000 in 2013.⁠³ ODIHR gives the exact figure as 250,159 eligible voters.⁠¹

On September 5, 2013, four days before election day, the ministry disclosed a programming error in the voting client “that caused weak encryption in some 29,000 electronic votes”.⁠¹ It released corrected software and tightened access to the ballot box servers.⁠¹

After the election, the ministry concluded that the trials had provided useful information and experience but that it would not continue them, citing “major political disagreement” over the trial and repeated debate in the Storting (parliament).⁠³ The Storting’s Standing Committee on Scrutiny and Constitutional Affairs took note of that decision in its May 2015 recommendation.⁠³

How it worked

Norway’s 2013 internet voting process, as described by ODIHR, began with a polling card mailed to each eligible voter carrying instructions and a set of “securely printed, unique return codes for each political party,” four digit numbers that differed for every voter.⁠¹ The voter authenticated, chose a party list, and submitted the vote. The system then sent a return code by SMS, which the voter could compare with the code printed beside the chosen party. Checking was optional: “completing this verification step was not necessary in order to cast a vote”.⁠¹

The return code design addresses a specific threat: malware on the voter’s computer that silently changes the vote. ODIHR explains that return codes inform voters “that their ballot was cast as intended and recorded in the system as intended, meaning that the ballot was not intercepted or altered by a computer virus”.⁠¹ The cryptographic protocol behind the codes is described by Kristian Gjøsteen, whose paper states that “return codes allow voters to verify that their ballots will be counted as cast” and that the protocol’s security “relies on a novel hardness assumption similar to Decision Diffie-Hellman”.⁠⁴ In plain terms, separate servers cooperate to compute a code from the encrypted vote without any one of them seeing the vote, and the code reaches the voter through a second channel (the phone) that an attacker on the computer would also need to control.

Coercion resistance relied on two rules. Each voter “could cast any number of electronic votes but only their final vote was counted,” and voters “could also vote traditionally on paper, either during early or advance voting or on election day, cancelling all their electronic votes”.⁠¹ Internet voting was closed on election day,⁠³ so a paper vote always remained available as a final override.

Oversight in 2013 rested with the new IEC: three county election committee chairs, three ordinary voters from pilot municipalities, a cryptographer, an election researcher, and a data protection representative.⁠¹ It was tasked with safekeeping encryption keys, controlling how sensitive data was created and deleted, suspending voting if needed, and verifying that decryption was accurate.⁠¹ The ministry also funded training for interested voters to act as “electronic voting election observers” by comparing a hash of their vote with a value published on a public bulletin board.⁠¹

Evidence: measured findings

Norway’s trials produced official figures on scale and use:

The two 2013 percentages use different denominators (registered voters versus votes received) and are reported here as each source states them. In the trial municipalities, 47 percent of voters voted in advance in 2013, compared with 30 percent nationally⁠³

On turnout, the ministry’s documents point readers to the evaluation by the Institute for Social Research (ISF), “Internettvalg: Hva gjør og mener velgerne?”.⁠³ This review could not open the ISF report itself, so its turnout estimates are not quoted here. What the Storting committee recorded is the evaluation’s main conclusion as the committee read it: that it is not possible to a sufficient degree to secure reassuring conditions for secret voting over the internet.⁠³

On integrity and secrecy, the main measured event was the 2013 encryption error affecting “some 29,000 electronic votes,” which meant “system administrators with access to the electronic ballot box could potentially decrypt the ballots without the need for the secret decryption key”.⁠¹ ODIHR reports that the issue was brought to light by the IT auditor the IEC had contracted.⁠¹ No source reviewed here reports that any ballot was in fact decrypted or altered.

Failures and criticisms

Norway’s oversight body was the weakest point, according to ODIHR. The IEC “met rarely and its role appeared largely formalistic,” most members “were not conversant with the system and relied entirely on the MLGRD’s guidance,” and selection criteria were unclear, with the ministry involved in choosing some members, which “introduced the potential for a conflict of interest”.⁠¹ Although the IEC’s own auditor found the encryption error, “it was the MLGRD that briefed the IEC in writing about the issue,” and the IEC accepted the ministry’s fix as sufficient.⁠¹ The system was designed to be end-to-end verifiable, “however, the auditor was only tasked with verifying a limited number of aspects of the system”.⁠¹

Process gaps from 2011 carried into 2013. ODIHR listed recommendations not implemented, including publishing a complete schedule, documenting procedures for secrecy and integrity verification, and contracting “a third party to perform code review of all source codes”.⁠¹ In 2011, printing problems with return codes delayed some polling cards.⁠¹

Independent verification barely happened. The ministry said it would accommodate media or parties wishing to verify, but “no such third parties showed any interest, with the result that the only organization performing verification was contracted by the MLGRD itself”.⁠¹ Voter verification training “was taken up only by a limited number of voters”.⁠¹

Secrecy in uncontrolled settings remained the central objection. ODIHR records that “most of those opposed to Internet voting cited lack of secrecy and potential for coercion while voting in an uncontrolled environment as their primary concern”.⁠¹ Revoting helps only a voter who can later vote privately, and a voter’s own household may be the source of pressure.

Competing interpretations

The trials showed internet voting can be run well. Supporters can point to ODIHR’s findings that the system “enjoyed a high level of trust” among interlocutors and that “experts on electronic voting expressed satisfaction with the mechanisms to verify the integrity of election results and safeguard the secrecy of the electronic votes”.⁠¹ The return code and revoting designs were serious answers to malware and coercion, and the 2013 error was found by the oversight process and fixed before election day.⁠¹

The trials showed the limits of good design. Critics can point to the same report: an oversight body that could not independently judge the system, a cryptographic error that undermined secrecy for tens of thousands of votes, no outside code review, and no independent verifiers.⁠¹ On this view, Norway’s high institutional trust carried the pilot rather than evidence the public could check.

The decision was political, not technical. The ministry’s stated reasons were that the trials had been informative and that there was “major political disagreement”;⁠³ the committee emphasized secrecy.⁠³ A reasonable reading is that technical safeguards could not settle a value question: whether the convenience of remote voting is worth any reduction in the assurance that each vote is cast alone. Different democracies answer that differently; compare Estonia and Switzerland (Swiss e-voting trials).

Lessons

These lessons are interpretations from the record.

1. Oversight needs independent competence. An oversight committee that depends on the operator for understanding cannot provide assurance (see governance).
2. Verifiability designed is not verifiability done. An end-to-end verifiable design delivers little if auditors check only part of it and no independent party checks at all.⁠¹
3. Revoting is a partial answer to coercion. It protects voters who can later act privately; it cannot protect voters who never have privacy. Norway kept a paper override and closed online voting on election day.⁠^1,3
4. Time pressure is a security risk. A narrow, late political decision shortened development and testing.⁠¹
5. Convenience did not prove to be a turnout tool. Online voting attracted a large share of voters in pilot towns,⁠³ but this review found no official claim that it raised turnout, and the government did not cite one.

Application to this framework

Norway’s experience maps onto the My Vote Forward framework’s separation between “My priorities,” “My opinion,” and “My vote.” The framework allows people to revise priorities and opinions over time, and it treats the private vote as a distinct act with stronger requirements (see private voting). Norway shows why: a revisable online vote is a coercion mitigation, not a guarantee, and the official vote must sit inside legal oversight with independent verification.

The case also informs the framework’s governance principles. Whoever operates any future voting component would need oversight that is selected transparently, technically competent, and independent of the operator, plus open invitations for outside verification. Those are design requirements stated on audits and verification and security; Norway is evidence of what happens when they are thin.

Unresolved questions

• What did the ISF evaluation measure about turnout, voter trust, and voting in the presence of others? This review could not open the report and relies on the committee’s summary.
• How many Norwegian internet voters revoted or overrode an online vote on paper, and what would those numbers reveal about coercion or simple changes of mind?
• Can oversight bodies for cryptographic voting be staffed with enough independent expertise in smaller jurisdictions?
• Would the 2013 outcome have differed if the decision to continue had come a year earlier, allowing full code review?
• Is there any remote voting design that gives election day secrecy assurance without a supervised setting?