Last updated on December 17, 2013

Despite using electronic voting for many years in the Netherlands, the Ministry of Interior, which is in charge of the overall framework for elections, did not have the technical capacity to properly manage and regulate the electronic voting process. This allowed vendors too much control over the implementation of electronic voting technologies and the setting of standards for these technologies. Consequently, vendors and the ministry failed to update voting technology in line with modern security requirements, posing severe security risks to the electronic voting process.

In the late 1960s, the government of the Netherlands commissioned the Dutch Organization for Applied Scientific Research (Toegepast Natuurwetenschappelijk Onderzoek, TNO) and the Dutch Apparatus Factory (Nederlandse Apparatenfabriek NV, NEDAP) to design and build a voting machine. At this time, the Ministry of the Interior was responsible for developing the overall legal framework for elections, including ensuring proper standards and regulation of voting machines. During the initial design process, the ministry chose not to set any legal requirements for TNO and NEDAP. The decision to award TNO and NEDAP creative control over the voting machines set a precedent that gave Dutch suppliers control over the ministry on electronic voting project management and regulation.

Voting machines became more widespread in Dutch elections during the late 1980s and 90s, yet the ministry’s regulation of these technologies remained limited. Vendor influence over electronic voting continued in part because of the ministry’s lack of knowledge of electronic voting technologies. The ministry was unable to determine clear requirements regarding functionality, integrity and security of voting machines. One paragraph of the Electoral Code (Article J33, paragraph 2) did specify some requirements for voting machines (such as secrecy of the vote and a clear candidate list; however, legislation was largely process-oriented and did not delve into standards or technical requirements.

The ministry also relied heavily on vendor knowledge when revising standards on electronic voting, which created a conflict of interest. TNO, for example, was included in a ministry working group in 1990 and tasked with drafting technical regulations for voting machines. Their suggestions did not require any security features or a voter-verified paper audit trail (VVPAT), nor did it address the possibility of manipulation. Consistent with TNO’s recommendations, no such regulations were ever issued by the ministry.

In the absence of a strong regulatory framework, vendors did not update technology in line with modern security requirements, making the voting machines vulnerable to internal and external security threats. The ministry also overlooked several warning signs with the voting machines, including problems that were discovered with similar machines in Ireland as well as concerns raised by the Electoral Council. For example, the Electoral Council advised the ministry on several occasions to introduce a certification procedure for the tabulation software. The ministry did not enact regulations in response to these concerns.