Confidence assessment: findings and recommendations
Intro
In May 2019, 10 pilot schemes trialled ways of implementing identification of voters at polling stations.
This is an assessment of the confidence in each type of identification.
There are some technical recommendations to improve the strength, integrity and usability of this voter ID model, which would benefit the security of the process for operation at a larger scale.
Background
Richard Dykes was asked by the Electoral Commission to undertake an independent assessment of the security provided by each of the different types of identification used at the May 2019 pilot schemes to feed into its evaluation. The Commission was interested in:
- The level of security provided by each ID document for each model
- The extent the issuing process can provide identity assurance
- The extent the checking process can provide identity assurance
- Recommendations on the issuing and checking processes to improve assurance
Background
Although voters at polling stations in Great Britain do not currently need to show ID to vote, the UK Government is exploring ways in which voters in Great Britain could be required to show a form of ID before they vote at polling stations in future.
The Electoral Commission is responsible for evaluating the Government’s second tranche of voter identification (ID) pilot schemes, trialling voter identification measures in ten local authorities for the May 2019 local elections. The evaluation of the pilot schemes cannot judge whether the requirement to show identification prevented fraud occurring at these elections. This security assessment seeks to address that gap by objectively considering how secure each identification type used is as a form of voter identification. This report provides a comparative assessment of the level of confidence in voter identity provided by each form of identification document.
This voter ID assessment report explores the following aspects regarding the pilots, by:
- Identifying relevant common standards for identity verification, particularly as applied in relation to public service provision in the UK.
- Establishing a framework to review different types of ID being used in the pilots, in order to provide an assessment of the level of security provided by each of the documents used in the pilot, as a form of voter identification.
- Applying those standards where appropriate, to assess the degree to which the issuing process for each of the documents deemed acceptable in the 2019 pilot schemes can provide assurance about the identity of the holder.
- Similarly, assessing the degree to which the checking process for each of the documents deemed acceptable in the 2019 pilot schemes can provide assurance about the identity of the holder.
- Where feasible (taking into account the extent to which Returning Officers or Electoral Registration Officers have control over the issuing process) making recommendations about possible enhancements to the issuing process that could improve the level of assurance provided by each of the document types specifically issued as part of the 2019 pilot schemes.
- Making recommendations about possible enhancements to the checking process that could improve the level of assurance provided by each of the acceptable documents in the 2019 pilot schemes, including any simple additional guidelines or checks for polling station staff about what they should look for when checking ID.
Framework for assuring voter identification
Before the voter ID methods trialled in the pilots can be assessed, this framework establishes, contextualises and justifies the relevant factors and criteria that will be considered in this assessment.
Note that processes related to anonymous, postal and proxy voting have been excluded from the scope of this assessment, as have factors regarding eligibility to vote, by reference to nationality, address catchment or multiple residential addresses.
Framework for assuring voter identification
The UK Government has established various sets of identity related standards, containing regulations or guidance, to support the providers of public or financial services. These sources of guidance should be applied, where appropriate and beneficial for gaining sufficient confidence in the identity of their service consumers, in order to mitigate identity related risks sufficiently to transact or share personal information:
- GPG 44 - Cabinet Office GDS Good Practice Guide (GPG) 44 (currently v2.0, Oct 2014) – Authentication and credentials for use with HMG online services
- GPG 45 - Cabinet Office GDS Good Practice Guide (GPG) 45 (currently v4.1, Apr 2019) – Identity proofing and verification of an individual
- MLR 2017 - Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
- NDFU 2016 - Home Office NDFU Guidance on examining identity documents 2016
Many other forms of departmental, local or business sector guidance also exist which may also have some relevance to the context of voter identity, however most of these are themselves derived to some degree from one or more of the authoritative sources listed above. For example DWP have adapted such guidance to produce their current Common Standards for Identity Verification and Authentication (2017), used to support the verification of benefits claimants’ identity in all channels, not just online. Similarly the MLR 2017 regulations are implemented by all banks, solicitors and estate agents to help prevent fraud and money laundering by their customers.
The UK Government supports the representation of public service and business interests in the standardisation of identity practices across the EU and internationally, for example through contribution to the development and review of EU eIDAS regulations and BSI PAS 499. As such, taking guidance from the authoritative UK Government sources should be regarded as being the most appropriate way to remain aligned to EU and international standards.
The GPG guidance reflects distinct levels of confidence in each of the elements of identity verification and authentication, in order to address the specific need to mitigate a range of risks from low impact (non-financial) to the highest levels of fraud or national security. Likewise MLR 2017 is also primarily aimed at mitigating the risks of high value fraud.
In order to make a practical assessment of the confidence in voter ID to be gained from the trialled identification approaches, or indeed any protection measures, it is important to understand the key risks to electoral integrity that may be identity related and the impact those risks could have on electoral outcome, including any potential negative impacts of the additional identity measures. The following is a non-exhaustive and qualitative review of the more relevant risks, which may also occur in combination to achieve a compromise of electoral integrity:
- Electoral identity fraud is not identified, resulting in an incorrect election outcome;
- The public do not have confidence in the integrity of results of UK elections, due to perceived threats to, or perceived weaknesses in, the UK electoral system;
- An ineligible individual registers to vote, in order to pervert the outcome of a future election;
- An individual registers a false or stolen identity as an elector, in order to pervert the outcome of a future election;
- An organised registration of multiple false, ineligible or eligible-but-unknowing individuals, in order to pervert the outcome of a future election;
- An individual is registered without their knowledge to an incorrect address, resulting in capture of the named individuals subsequent polling card, to make a personated vote;
- One or more polling cards are illegally obtained from an address, in order to setup false voter attendance and fraudulent votes cast at polling stations;
- Identity mules are organised to present a set of personated identities and vote in a number of polling stations (one identity/polling card for one vote each per polling station), in order to pervert the outcome of an election;
While some of these risks have occurred historically, to compromise the integrity of elections in Northern Ireland (for which NI voter ID measures were later applied), there have not been significant numbers of identified instances of personated attended voting in polling stations in Great Britain, beyond small numbers of individuals operating in isolation. The impact of isolated individuals compromising a single vote is mostly minimal, however an organised exploit to one or more voting areas could potentially throw an election, especially in a marginal area.
The following statements of principle are derived from both previous reviews of electoral integrity and identity assurance guidance; these should help in keeping a balanced and pragmatic view of the value of specific pilot measures for securing voter ID in the context of the overall electoral process:
- An identity is a combination of characteristics that identifies a person; a single characteristic is usually not enough to uniquely identify a person;
- Evidence of the full name, their date of birth and some personal address history is generally required to support unique identification of an individual; this may require more than one independent source of evidence that correlate to the same full name;
- Some meaningful degree of validation or verification of evidence is advisable to resist personation, forgery or counterfeit;
- Confidence in personal identity may be built up in steps at separate times, however there should be a proportionate measure to ensure the identity is in the control of only the same person at each step (i.e. from registration through to voter ID checking);
- The strength of any security process should be consistent across the primary journey as well as all exception handling processes;
- Document checking in polling stations is constrained to simple manual or technology-assisted processes requiring only minimal training and non-specialist devices, if any.
Three identity assurance processes in particular are often confused with each other, or are not otherwise differentiated adequately in use: validation, verification and authentication [of identity]. Validation and verification are both defined below, whereas authentication only relates to the need for a subsequent verification some time later than the first, where a secure token (credential) is used to ensure the same person is present on the subsequent occasion(s), as an alternative to re-proofing that identity each time.
The guidance in the two GDS GPGs addresses the following aspects if identity assurance:
Identity checking – “is the person who they say they are?”:
- Strength – the documentary or other/electronic evidence is hard to forge or counterfeit;
- Validity – the identity exists and the evidence is genuine and valid;
- Activity – evidence the identity has behaved normally in the real world over time;
- Fraud – no records showing that the identity is related to known fraud or high risks;
- Verification – that the identity belongs to the person who is claiming it;
Authentication credentials – “is the person the same individual as previously?”:
- Quality – the documentary or electronic token is strong, and hard to crack or duplicate;
- Issuance – ensure the token is securely delivered intact only to the correct person;
- Integrity – resilient to compromises such as disclosure, replay or personation;
- Monitoring – recognise normal good behaviour and suspicion of misuse or theft;
- Checking – test the token is genuine and valid, and under the control of the owner.
Like the MLR and NDFU guidance, the GPG guidance also then covers operating aspects of how to assess evidence as acceptable for the level of confidence required in a service context. This is most pertinent to either issuing or checking identity documents or tokens.
Assessment of voter identification pilots
In 2019 the UK Government legislated to allow pilots to take place in 10 local authorities. Authorities had a choice of three pilot types:
- Poll card model (or one form of photo ID)
- Standard poll card (used in NW Leicestershire)
- Technology enabled poll card (used in Mid Sussex & Watford)
- Mixed model (used in Braintree, Broxtowe, Craven, Derby & North Kesteven)
- One form of photographic ID or two forms of non-photographic ID
- At least one document should include a residential address
- Photographic model (used in Pendle & Woking)
- One form of photo ID only
In these 2019 pilots, a consistent list of ID documents deemed acceptable was provided; this full list of accepted ID can be found at Annex A, reproduced from the Government’s report on equality considerations for these pilots. In all cases, local authorities were required to offer a free locally issued ID, although local processes and designs differed.
To bring the identity standards into the real world of the processes related to elections, it is appropriate to understand these identity assurance factors and their relevance in the context of the experience of voters engaging with the electoral processes, which may be summarised for the voter identity journey (rolling in any exception processes) as:
- Individual electoral registration by a voter;
- Validation of voter registration by the Electoral Registration Officer (ERO);
- Optional identity verification for issuance of a local electoral ID certificate;
- Issuance of a standard or technology enabled voter polling card;
- Voter identity checking at a polling station on behalf of the Returning Officer (RO) or Presiding Officer (PO).
The standard identity assurance factors relevant to the methods trialled by the voter ID pilots may be illustrated (in general terms only here, and at differing degrees of assurance) by drawing from this voter identity journey in the following examples:
Strength – the documentary or evidence is hard to forge or counterfeit
- Initial voter registration only requires a declaration of a unique real world identity (full name, date of birth, some form of address) plus either a National Insurance Number (NINo, the DWP & HMRC personal record reference) and/or recent address history;
- Subsequent separate proofing for the pilots requires presentation of either acceptable photo ID or officially issued documents evidencing the claimed identity (many of which have no tamper-resistant security features).
Validity – the identity exists and the evidence is genuine and valid
- At registration the NINo is checked against a DWP or HMRC data source;
- For some pilots, a voter may present (at a polling station) two apparently original and acceptable documents, both consistently evidencing the full name, and at least one of them showing their residential address, that must match an entry on the electoral roll;
- Otherwise for the pilots a voter may be required to present a polling card which they have received in the post or as a replacement in person, on which the personal details exactly match a record on the electoral roll;
Activity – evidence the identity has behaved normally in the real world over time
- In the standards only and identity lacking Photo ID needs to be checked for evidence of activity at low assurance.
- Here the appropriate option is to show two or more documents evidencing the identity, which should both in combination meet the requirements of MLR 2017;
Fraud – no records showing that the identity is related to known fraud or high risks
- There was no evident checking of voter identity or bank cards presented against a counter-fraud or identity theft black-list;
Verification – that the identity belongs to the person who is claiming it
- There is a basic verification of the person claiming the identity at initial registration, by posting a confirmation to their registered address;
- Voters are asked, as a counter-fraud measure, to verbally declare from memory their full name and registered address; polling cards and/or voter ID are not checked until after an eligible electoral roll record has been found matching the voter’s declaration;
- A voter’s address is in effect verified where both (i) the polling card is posted to that address, and (ii) that polling card is required to be presented at a polling station, where it is checked for physical authenticity (e.g. QR barcode) and/or validated against the electoral roll;
- A voter may present a photo ID that has a good likeness, matching the full name and potentially (not mandated) the address on the electoral roll, and the document appears to be authentic to the non-specialist polling staff checking it.
There are two instances in which the electoral authorities check identity and then issue a document themselves to a voter, for subsequent presentation at a polling station, effectively as a credential to link those events, are:
- In all cases, issuing an individual polling card by post, or a replacement in person;
- For some pilots, issuing a local electoral ID certificate, some with a photo.
For this assessment, it is important to note that these two documents are therefore not in themselves original evidence of identity in the overall electoral process, but merely a token indicating a previous identity check by the electoral authorities.
Quality
- A QR barcode makes successful forgery or counterfeit of a polling card more difficult, as knowledge of the coding mechanism of a valid electoral record would be required.
Issuance
- Polling cards are generally posted to the registered address, to limit the opportunity for one getting into the hands of anyone with no access to that address; note this only adds any benefit if the polling card is actually required to be shown at polling time.
Integrity
- A local electoral ID certificate with a genuinely attached or printed photo likeness provides strong evidence that it was issued to the same person later showing it.
Monitoring
- While difficult at polling time, statistical data gathered by election monitors and polling staff may later show unusual or unexpected trends in voter behaviour in particular areas, such as much higher use of one particular form of identification at polling than in other areas, thus alerting to the possibility of some external influence on that community.
Checking
- Security features of any physical document, including type of paper or printing method, and inclusion of a testable QR barcode or a photo to check likeness.
The standards have no exhaustive list of which documentary types have what strength, however they do provide a clear scoring criteria in GPG 45 and a broad hierarchy in MLR 2017. Of those identification documents acceptable to the pilots, their value in terms just of issuance strength may be summarised as follows (See Annex A for the detailed list):
List 1
High Strength (score 3+, MLR primary photo ID)
These are all officially issued photo ID with security features that uniquely identify the individual and provide a unique reference to the record held by the issuer. The photo likeness binds the document to the holder, and their real world identity was first verified by the issuer.
These are the passport, driver licence photocard, NI electoral ID card, biometric immigration documents, EEA photo ID cards and an MOD ID card.
Medium Strength (score 2)
While not as strong as the primary photo ID, the same basic criteria each still apply but to a lesser degree. Given that specialist document checking cannot be applied in a polling station, these identification documents should be just as appropriate in this context.
This class of documents included a PASS age card, the various travel or parking permit photo cards and any local electoral ID certificate.
GPG 45 & MLR 2017 both include a photo ID firearms certificate in this category rather than as a List 2 item in the pilots.
List 2
Medium Strength (score 2, MLR primary non-photo ID, generally with date of birth)
Some officially produced documents are issued with unique references and physical security features in the paper or printing, and after robust verification or certified witnessing, although they lack a photo likeness. These carry more weight than other paper evidence as they can be validated against a data source and they are harder to forge or counterfeit.
This group includes the official registration certificates for birth, adoption, marriage and partnerships plus a firearms certificate.
Low Strength (score 1, MLR secondary evidence of address)
These are generally documents that evidence routine living and financial activity of the individual named at their residential address, that can be uniquely referenced (e.g. by account number) with the issuing institution, and which should be required to be produced in original form on the issuers own printed headed document paper, rather than home printed from an electronic form (unless there is a QR barcode or similar validation printed).
This group includes almost all other items on the pilot List 2, except for Bank Cards, Cheque Books and a National Insurance Number Card.
It is worth noting that neither GPG 45 nor MLR 2017 would suggest that evidence is adequate when only two items at Low Strength are presented, however one medium strength official document (even if the address may not be current), when supported by a second item showing a recent and still current address should be acceptable.
There are groups in the population who will be unable to meet this requirement due to a lack of original documents in their possession (and often without a bank account); these will generally be individuals who would also be relying on some support from benefits and charity. For the electoral context, if a letter of benefits award is offered, it could be treated as a primary non-photo document, if supported by additional secondary evidence of address (which may be transient).
Bank Cards, Cheque Books and National Insurance Number Card
While bank cards, cheque books and national insurance number cards are included as acceptable in List 2 for the pilots, they should be regarded as too weak a form of identification when offered in a context where they cannot be validated or verified at the time, as they do not provide a printed unique person identity alongside the numerical identifier on the card; i.e. they lack both date of birth and address information, and often no forenames. Note that while banks can verify bank cards electronically using a PIN checker and an online verification of the resulting code; this isn’t available to polling stations.
A counter argument could be made for bank cards that still carry a signature strip on their reverse (no longer universal) as well as a full name. This was not trialled in the pilots, however if the voter could replicate their card signature in the presence of polling staff, this would give some confidence in their ownership of the card and thus the name on it. This is however not a recommended approach due to complexity and likely exceptions.
Although the National Insurance Number of the voter is the preferred validation identifier used to validate an individual’s real identity following a standard electoral registration application, this identifier is not available on the electoral roll to staff in polling stations. The card cannot therefore be validated to an adequate degree to relate back to the original voter registration, and is therefore of no real value as identification at polling.
In standard electoral procedures, voters are currently not required to present their polling card in order to be permitted to vote; they may simply declare their personal details which are checked against the copy of the electoral roll at the polling station.
The standard polling card is generally issued by post to each elector at their registered address on the roll a few weeks ahead of polling day. It is usually a printed card bearing the full name and address (but not date of birth) of the elector, and by being posted has in effect verified the address of its holder by polling day, unless it is a replacement collected in person using some other local procedure (if any) for identity verification.
There are three contexts in which the pilots trialled further use of the standard polling card:
Standard - as an optional List 2 item of secondary address evidence.
Where the poll card has been posted and received by the voter, this postal verification provides a reasonable link between identity at registration and at the polling station. For most voters there will have been a validation of personal details against their National Insurance record with HMRC/DWP, and then a postal verification. As with any other secondary address evidence, any similar person (i.e. by apparent age & sex) with access to that address, and therefore access to the poll card, could attempt to personate the real person.
Standard - On its own as an authentication token (in place of photo ID)
In this use case only the polling card is required to be produced in order to cast a vote in the name of the associated identity on the electoral roll. In this case the real identity is validated by National Insurance record at registration, and the address verified by post (if so delivered). This is a weaker use case when the card is used on its own and not used in conjunction with another List 2 document. This is however still of some real practical value, if only at a low level, and certainly better value than providing no physical evidence at polling.
Technology Enabled – on its own as an authentication token (in place of photo ID)
Two pilot areas trialled use of a polling card enabled with a printed QR barcode on its reverse. Tablets with the Modern Democracy QR barcode reading and identity validation app were provided to polling stations. In issuance terms, the technology enabled polling cards follow the same processes as the standard cards. The QR barcode provides a stronger defence against attempts to forge or counterfeit a card, as the codification of the QR barcode is designed to enable the personal details on the card to be validated simply, and checked automatically against the register. There is still no verification of the person’s real identity by this method; no different in this respect to any other non-photographic evidence. This does provide strong enforcement of one record only having one vote…though this has not been identified as a significant electoral integrity risk, as the one vote could still potentially be personated (e.g. in multiple occupancy dwellings).
All pilots were required to have the capability to provide a form of local electoral ID certificate, and such a certificate required a photo likeness where the trial method required presentation of photo ID. The essential requirement for the capability to issue such a certificate locally is to provide a fall-back method to support those voters unable through circumstances to present standard identification documents of an acceptable type.
There is less uniformity in the approaches taken and formats used for issuing a local electoral ID certificate, although generally templates to support trialling a photo ID model included a photo likeness. Some (if not all) local electoral authorities asked potential voters to offer a suitable and trusted person to demonstrate their own identity and then attest to the identity of the applicant for the certificate. They may take and/or incorporate a suitable photo likeness in the certificate issued then by post or (more likely) in person. Some authorities then incorporated a replacement polling card in the reverse of the certificate; in any case each authority (regardless of pilot group) would regard the local electoral ID certificate as the only evidence of identity that would then be required at polling.
Where a local electoral ID certificate is issued without a photo likeness, the voter is thus able to meet the identity checking requirement, following the prior attestation, in circumstances where the original polling card would have been insufficient on its own, i.e. the mixed and photo ID only pilots. This process would be superfluous in the pilots that accepted only a polling card, and was never used in such cases.
As the local resources available to an electoral authority may be unable to produce and issue a document with advanced security features (such as holograms, relief printing effects or watermarks), the ID certificate with no photo likeness is a weak token to link the attested identity to the voter presenting it at a polling station, however it is certainly no worse than the standard polling card identity model. Adding a photo likeness when issued does at least provide a visual verification at the polling station that the same person is present, even though the document itself may have no meaningful security features.
In practice very few local ID certificates were produced for the pilots, as most of those who actually applied already possessed adequate evidence in the form of other documents. For example Woking had 37 local certificates issued and produced to polling stations, being only 0.02% of the voters identified before voting; this is however a fairly affluent area which may not reflect the needs of more challenging areas.
All the pilot areas have issued training materials that appear consistent with the pre-pilot common guidance on both the acceptable list of identification documents and on the procedures for voter eligibility and identity checking in polling stations. In the absence of any direct evidence, for this assessment it is assumed that all pre-polling procedures are followed as per the guidance in the five part Electoral Commission Guidance for Electoral Registration Officers.
The confidence gained in the identity of a voter at polling time has been built up over all the steps by which there is interaction between that voter and the electoral authorities, so long as there is an adequate link or ‘bind’ between a series of separate steps over time. For this reason the evaluation of ID checking will consider the end-to-end journeys.
As the methods in each polling station appear to all be consistent with the pilot method selected for trialling in each pilot area, it is only necessary to consider each of the distinct identification tests used:
- Standard polling card presented
- Technology enabled polling card presented
- One form of photographic ID presented
- Two forms of non-photographic ID presented
- Local electoral ID certificate presented
All electors who have previously made a successful and validated individual electoral registration will, a few weeks ahead of the election date, receive a standard polling card at their registered address. In identity terms the original polling card on its own has low evidential strength, however in process terms there has also been a basic validation of that identity against Government data, and verification of the postal address.
A replacement polling card is normally marked as such and may have been issued in person; it wasn’t clarified whether an ID check may be required for in person collection;
In pilots where a polling card was accepted on its own, the polling station staff take the polling card and require the voter to state their name and address without reference to the card, and the stated identity is then checked against the electoral register before the polling card is then checked for a match. The voter’s name and address are then called out before ballot papers are issued. These measures were applied to mitigate vote fraud, and they would certainly make organised use of identity mules harder to be convincing.
On balance this method provides some validation of a real world identity with verification of address and tested knowledge of the persons claimed personal details, plus a link through from registration to voting. The user experience of this process is really no more challenging than the general process, adding only the need to save and bring their polling card to vote. This approach therefore does effectively provide a reasonable but low degree of confidence (in terms of the verification standards) in the integrity of the resulting vote, unlike the current optional process, which does not require a poll card to be presented.
To the voter the process here will seem identical to the standard polling card method. An investment in technology is however required to support issuance of the polling card with a QR code, as well as the electronic scan of that code and an automated check against the electoral register in the polling station.
The security benefit is a stronger authentication bind between the register record and the card presented at polling; i.e. defence against counterfeit polling cards related to existing register entries. There is no historic evidence that this form of personation attack has been attempted, and given that the real standard polling card may also be presented, the duplication would be detected to enable investigation. The technology may even reduce identity confidence, as the voter’s declared identity is not manually compared with the electoral roll.
This method would appear to actually offer little or no benefit to electoral integrity for the increased cost and complexity of automating the process.
The early part of this overall process is no different to the standard polling card process, and indeed this option is offered as an alternative to the polling card paths in those pilot areas. The only difference in the checking process is that the identity check following the register eligibility check may be satisfied with a single item of acceptable medium or strong photo ID.
This does however require the polling staff to have some training in recognition and basic physical inspection to determine if (to the inexpert eye) the documents are genuine and haven’t been tampered with. There is no data available to determine how effective these checks were in practice, as there was no sheep dip process to sample any of the voters and their evidence.
This approach is however relatively hard to attack in a bulk manner, and is therefore likely very effective as a deterrent against organised attack, even if a few dodgy documents do get accepted undetected in small numbers. There is also no strong correlation required between either date of birth or address of the voter between the photo id and the electoral register, however as the personal verification is stronger, this can be ignored safely here.
From the pilots, it was apparent that a good proportion of voters do routinely carry their driving licence photocard or bus pass, and probably welcome the opportunity to vote despite forgetting to pick up their polling card. This makes this method worthwhile as an option to the mandatory presentation of a standard polling card.
In process terms the mixed model checking process is of course the same as the other manual evidence checking methods. In principle this method provides greater confidence in the current address of the voter for correlation with the electoral register, as it goes beyond requiring just the polling card (although the polling card is an option for one piece of evidence). The process is more demanding for polling staff to check given the much wider range of potential evidence that may be produced, and the practical difficulty in differentiating genuine from home printed statements, for example.
In MLR terms, the objective of this specific method is to enable correlation of a more recent/current address with official identity evidence that lacks such an address. GPG 45 has no profile that would accept a low proofing with only two weak items of evidence. In the electoral context the voter’s official identity has been validated at registration, and the polling card provides a verification of current address – both with much more simplicity than the ‘two documents’ method here, and with frankly little different confidence in identity.
Data from the Craven pilot shows that the vast majority of voters taking this option produced their polling card supported by a bank card from their wallet; the bank card was produced as much as 10 times more often than a bank statement or utility bill. In the real world the bank card offered no proofing value in a polling station context, and the statements or bills (which are increasingly emailed to customers these days) offer little if anything in confidence in addition to a polling card.
If two statements or bills are offered together stating a full name, assuming they really are both genuinely posted to the individual at the same address (not required in the pilot rules), then they should give as much confidence in voter identity as would a polling card, as all should have been obtained by post at the address. This was however a very little used option taken in the pilot at Craven for which data is available.
Given the training and checking complexity, and the high chance of ineligible documents with no real proofing value being accepted, this method provides very low assurance for the effort involved.
As previously stated, where the identity checking requirement is for documents issued by parties other than the local electoral authorities, then it is essential that a local electoral ID certificate or its equivalent may be provided to eligible voters who due to circumstances are otherwise unable to meet the requirement. The attestation process is probably the only appropriate identity verification method possible to enable this approach, however it should be recognised this is still only a relatively weak assurance of identity.
In practical terms any of the pilots that would accept a polling card on its own would not have a need to produce a local certificate option. Individuals who also have difficulty with having their identity validated at electoral registration already have fall back methods available to them under the Guidance for Electoral Registration Officers, including attestation.
Overall Findings and Recommendations
While each of the identity checking methods trialled in the pilots have strengths and some disadvantages, there is a clear baseline or benchmark with the standard polling card method, which has a low but meaningful level of assurance that can be linked to preserve a consistent level of confidence in identity throughout, from initial electoral registration to checking at a polling station. The various linked validations and verifications may not be hard to compromise in small numbers, however they should thwart and enable detection of organised or bulk attempts at compromise. At minimal cost over traditional procedures, it also provides a user journey that is accessible to nearly all voters, and straightforward opportunities for exception handling where extra support is required by those in need.
The extra assurance of the QR coding of the polling card may give an impression of a positive security measure and a way to embrace the digital opportunities out there, however from a meaningful assurance perspective this is addressing a risk that is not significant and potentially enabling other exploits, as well as being costly. This does not offer a genuine assurance improvement. Although not yet trialled, capturing a digital photo as part of electoral registration (much as with bus passes) to enable a photo printed polling card may give a simpler way to provide a more positive and verifiable bind with the person throughout the journey, and still not require expensive technology in polling stations.
Where voters happen to have a driving licence photocard, passport or bus pass, in particular, these enable effective identity verification with even just an inexpert physical inspection in polling stations, and may be more convenient than remembering a polling card for some. It should also deter or detect organised bulk compromise attempts. The main weakness of this approach is that a significant proportion of voters in some areas will not already have one of these List 1 documents; a method is only as good as its weakest component, and here solving the needs of those without photo ID is the actual key to any confidence in voting integrity. This method should therefore be offered as an option for those who do find it convenient. Basic training to recognise and check just the common or popular List 1 photo ID is neither expensive nor time consuming, as has been trialled.
While the two document option appears at first glance to offer a higher assurance than the polling card method for those with no photo ID, in reality the approach taken was compromised by the use of bank cards in this context, and it will be increasingly hard for polling station staff without better training and special equipment to tell apart original and home print documents in this category. As there is no meaningful bind with the electoral registration process, this approach adds nothing of value to the polling card method, and should be discontinued. Where it was trialled the actual assurance was in 90% of cases based only on presentation of the polling card as one of the two items.
Finally the local electoral identity certificate was rarely used, however this must be offered in some form if photo ID is required and a polling card is not offered as the alternative. If this ID certificate is intended to be used as a single document as an alternative to a photo ID, these should really only be produced to incorporate a photo likeness. In reality if the polling card method is always to be an acceptable baseline, then the need for creating a separate local photo ID becomes redundant. A photo on the polling card would also effectively replace the need for a separate certificate process.
- Consideration for electoral integrity should be taken across the complete voter user journey from individual electoral registration through to polling stations, rather than just focusing on the polling related processes;
- The polling card may be much as per the current standard, subject to it or a marked replacement being delivered by post to the registered address, where there is sufficient time to do so before the election date;
- If a late replacement polling card must be issued in person, then a meaningful identity check must be carried out and recorded at issue, based on photo ID or presentation of information that can be validated from official data sources or attestation, as is available to support electoral registration;
- If feasible, there should be a unique reference number marked on all polling cards, that would be different on any replacement polling card later issued; this would enable revocation of a replaced polling card in a way that enables validation of revocation status at polling time (without technology) from the electoral roll copies provided to polling stations;
- If feasible, the polling card should be designed to incorporate one or more security features that could be readily and manually verified by polling station staff, to enhance resistance to forgery and counterfeit fraud; Home Office NDFU should be consulted;
- Consideration should be given to enhance the integrity and verification of polling cards by capturing a photo likeness as part of the individual electoral registration process, for printing (in black and white if necessary) on polling cards as standard;
- The verbal declaration of full name and address by voters, from memory without reference to their polling card or identification documents, should be incorporated as a standard counter-fraud measure in all polling stations, regardless of future methods applied (this is an example of good practice trialled in most of the pilots in May 2019);
- Consideration should be given to include the date of birth, collected at individual electoral registration, in the electoral register copy used by polling stations; date of birth should then be included in the voter’s verbal declaration, and validated against the electoral roll, as well as used to improve identification when the photo ID presented has no address (e.g. passports);
- List 1 should be retained as the formal list of acceptable photo ID documents, however a photo ID firearms certificate should be added;
- List 2 should be discontinued; if List 2 is retained in some form, the list should not include bank payment cards, cheque books or the old National Insurance Number Card, as these cannot be validated in any useful form in a polling station; List 2 items from non-Government sources should as a minimum include a full name and the current address;
- Outside Northern Ireland, if the polling card is accepted as a form of ID, the local electoral ID certificate should be discontinued as it would become redundant;
- Guidance to polling station staff should include monitoring indicators (such as numbers of each identification document presented, failures of any verification steps, etc) and stress the importance of alerting the Returning Officer early, if any suspicious patterns or behaviours are noticed that could indicate a potential breach of electoral integrity;
- If new digital or technology-based innovations in electoral processes are considered, then the process and technology applied should be properly risk assessed and assured to ensure there is only a resulting improvement to overall electoral integrity;
- The automated Individual Electoral Registration process currently relies on identity validation with HMRC/DWP to check the National Insurance Number records, or access to local authority data; consideration should be given to widening or changing the choice of authoritative networked whitelist (valid identities) and blacklist (associated with known ID fraud) data sources that could checked by using relevant personal identifiers (or by matching personal identifying information); Cabinet Office GDS should be consulted on best future practice for this (e.g. the Gov.UK Verify digital document checking service);
- Consideration should be given to whether the automated Individual Electoral Registration process may also in future benefit from integration with one of more networked identity providers, as may be available and officially approved, as an external source of identity validation or verification; e.g. the full Gov.UK Verify service or its future equivalent;
- Once feedback from polling stations who conducted List 1 document checks have been collated, a review of best practice and a revision of future guidance should be considered; Home Office NDFU guidance should also be consulted as previously;
- The findings and recommendations here should also be impacted against the anonymous, postal and proxy voting processes that were not considered in this assessment, as a consistent application of assurance measures is needed to maintain overall electoral integrity; attackers will always go after the weakest perceived component.
Annex
List 1 - (Photo ID, Mixed ID Model, Poll Card)
Where List 1 applies, an elector needs to bring one form of ID from List 1 to verify their identity in order to be issued a ballot paper. The following forms of ID will be accepted:
(a) a passport issued by a Commonwealth country or a country within the European Economic Area;
(b) a photocard driving licence (including a provisional licence) issued in the United Kingdom or by a Crown Dependency or by a Member State of the European Union;
(c) an electoral identity card issued under section 13C (Electoral identity card: Northern Ireland) of the Representation of the People Act 1983;
(d) a biometric immigration document issued in the United Kingdom in accordance with regulations made under section 5 of the UK Borders Act 2007([1]);
(e) an identity card issued in the European Economic Area which bears a photograph of the voter;
(f) a PASS scheme card (national proof of age standards scheme);
(g) a Ministry of Defence Identity Card;
(h) a concessionary travel pass funded by HM Government;
(i) an Oyster 60+ pass;
(j) a photocard parking permit issued as part of the Blue Badge scheme.
List 2 - (Mixed ID Model)
Where List 2 applies, an elector needs to bring two forms of ID from List 2 to verify their identity in order to be issued a ballot paper. At least one form of ID must contain the elector’s registered address.
(a) a valid bank or building society debit card or credit card;
(b) a mortgage statement dated within 12 months of the date of the poll;
(c) a bank or building society statement, or a letter from the bank or building society confirming the opening of an account, dated within 3 months of the date of the poll;
(d) a bank or building society cheque book or building society pass book;
(e) a credit card statement dated within 3 months of the date of the poll;
(f) a council tax demand letter or statement dated within 12 months of the date of the poll;
(g) a utility bill dated within 3 months of the date of the poll;
(h) a Form P45 or Form P60 issued within 12 months of the date of the poll;
(i) a poll card for the election;
(j) a birth certificate;
(k) a marriage certificate or civil partnership certificate;
(l) an adoption certificate;
(m)a firearms certificate granted under the Firearms Act 1968([1]);
(n) the record of a decision on bail made in respect of the voter in accordance with section 5(1) of the Bail Act 1976([2]);
(o) a driving licence (including a provisional licence) which is not in the form of a photocard;
(p) a statement of benefits or entitlement to benefits, such as a statement of child benefit within the meaning of section 141 of the Social Security Contributions and Benefits Act 1992([3]), or a letter confirming that the voter is entitled to housing benefit, within the meaning of section 130 of that Act;
(q) a student loan statement issued by the Student Loan Company dated within 12 months of the date of the poll;
(r) a National Insurance Number card or letter issued by Her Majesty’s Revenue and Customs.