Remote electronic voting is a voting model that allows eligible citizens to cast a ballot from outside a physical polling place, often through a secure mobile or web channel. It is used to improve participation for rural, overseas, and mobility challenged voters while preserving election controls.
How Remote Electronic Voting Works
Remote electronic voting replaces the physical polling place with a controlled digital channel, so the core design problem is not convenience alone but preserving ballot integrity, voter eligibility checks, and election secrecy across an exposed network path. The channel may be web-based or mobile, but the trust model still has to answer who can vote, how the ballot is cast once, and how the system resists tampering.
That makes remote voting a security-sensitive election workflow rather than a simple online form. The design has to account for authenticated access, authorization to vote, vote submission integrity, and system availability under public scrutiny. For a useful governance baseline, election operators can borrow from NIST Cybersecurity Framework 2.0 for governance, protection, detection, response, and recovery expectations.
Key Security Controls and Trust Boundaries
Remote electronic voting depends on layered controls because no single mechanism can protect every stage of the process. The voter interface must be reachable, the identity or eligibility check must be reliable, the ballot must remain secret, and the transmission and tallying path must resist manipulation. Each of those steps creates a distinct trust boundary that can fail independently.
Strong systems typically separate voter authentication from ballot content, protect transmission with modern cryptography, log administrative actions without exposing voter choices, and validate that a ballot is recorded exactly once. Public-key and certificate handling matter here because secure channel establishment and signed components often underpin trust in the voting application. Operationally, this aligns with broader control sets such as NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST SP 800-57 Key Management.
When identity proofing and authentication are part of the voting workflow, the control objective is to verify eligibility without creating a traceable link between the person and the ballot. That privacy and access boundary is one reason election systems are often evaluated against NIST Privacy Framework as well as security controls.
What Makes Remote Voting Harder Than In-Person Voting
In-person voting benefits from a bounded physical environment, visible procedures, and a lower probability of remote interference. Remote electronic voting expands the attack surface to endpoints, home networks, devices, browsers, and delivery infrastructure, which means the system must tolerate untrusted client environments and still preserve ballot correctness.
That broader exposure also makes usability and security trade off more visible. A voting system can be very secure and still fail if eligible voters cannot complete the process, while a system that is easy to use but weakly protected can undermine confidence in the election outcome. The practical challenge is to improve participation without weakening trust in the election process itself. This is why many election and public-sector guidance sets emphasize operational resilience and remote-access security, including NCSC UK Advice and Guidance.
Because the system is exposed to distributed users and third-party networks, availability is also part of the security model. Service disruption, denial of service, or failures in authentication infrastructure can disenfranchise voters even when no ballot is altered.
Election Assurance, Auditability, and Public Confidence
Remote electronic voting only works when voters, officials, and observers can trust the process without seeing private ballots. That means the system must support end-to-end assurance: eligibility checks, casting confirmation, secure storage, tally integrity, and post-election auditability. Where those assurances are weak, allegations of manipulation can persist even if no compromise is proven.
Independent verification is especially important because election technology is judged not only by whether it functions, but by whether it can be defended under scrutiny. Cryptographic logs, tamper-evident records, and reproducible procedures help establish confidence, but they must be paired with transparent governance and clear operational ownership. For election administrators, the more useful comparison is often with broader digital identity and trust-service governance, such as eIDAS 2.0, EU Digital Identity Framework, where high-assurance identity and trust services are governed as public infrastructure.
Risk and Threat Considerations
Remote electronic voting concentrates several high-impact risks into a single workflow, including ballot secrecy failures, voter impersonation, endpoint compromise, denial of service, and confidence loss from disputed results. Even when the cryptographic design is sound, operational weaknesses in device security, access control, or availability can create election-risk exposure.
Failure mechanism: Attackers or faulty implementations can exploit the client device, authentication flow, transmission channel, or backend tally path to alter, block, duplicate, or reveal ballots. A compromised voter endpoint is especially dangerous because it can manipulate what the voter sees or submits without changing the server-side vote record in an obvious way.
Impact: The result can be disenfranchisement, loss of ballot secrecy, disputed counts, or a broader collapse in public trust, even when only a subset of votes is affected.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-63 and CIS Controls v8 set the technical controls, while EU AI Act define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV — Govern | Remote voting needs governance, accountability, and risk ownership across election operations. |
| PR.AC — Identity Management, Authentication, and Access Control | Remote voting depends on eligible access without exposing ballot secrecy. | |
| PR.DS — Data Security | Ballots and election records require integrity and confidentiality protection in transit and storage. | |
| Recommendation — Assign clear owners for voter assurance, auditability, and incident response. Enforce strong eligibility checks while separating voter identity from ballot content. Protect ballot data with encryption, integrity checks, and tamper-evident handling. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Remote voter eligibility depends on assurance about who is being authenticated. |
| AAL — Authenticator Assurance Level | Remote voting relies on robust authentication strength for voter access. | |
| FAL — Federation Assurance Level | Federated remote voting flows depend on trustworthy identity assertions. | |
| Recommendation — Set the identity assurance level that matches the election's eligibility risk. Use an authenticator assurance level that resists account takeover and replay. Validate federation assertions before allowing ballot submission. | ||
| CIS Controls v8 | 6.1 — Establish and Maintain an Asset Inventory | Remote voting depends on knowing and governing the devices and services that support the election. |
| 6.3 — Manage Allowlist of Authorized Software | Voting endpoints are safer when client software is constrained and predictable. | |
| 16.11 — Incident Response and Management | Election operators need defined handling for tampering, outages, and suspected compromise. | |
| Recommendation — Inventory the systems and services that participate in remote voting. Restrict election workstations and supporting systems to approved software only. Exercise incident handling for vote-service disruption and integrity concerns. | ||
| EU AI Act | High-Risk System Governance | If AI components are used in voter-facing triage or support, governance obligations become material. |
| Recommendation — Govern any AI-assisted election support functions with high-risk oversight and traceability. | ||
Practitioner Guidance
Governance implication: Treat remote electronic voting as a high-assurance public trust system, not a standard web application. Election owners should define who is accountable for eligibility, secrecy, auditability, incident response, and public communication before the system is used in a live election.
Practitioner takeaway: The strongest remote voting designs do not rely on one control, they rely on layered assurance that can still be defended when the client device, network, or infrastructure cannot be fully trusted.
Related resources from NHI Mgmt Group
- How should organisations use qualified electronic signatures in remote onboarding across the EU and Norway?
- What breaks when remote onboarding relies on electronic signatures without qualified identity assurance?
- Why does online voting require qualified electronic trust services and digital certificates?
- What breaks when electronic voting is introduced without mature digital identity controls?
