[E-voting] Appeals to the Information Commisioner - progress and obstacles

Joe McCarthy joe.mccarthy at arkaon.com
Sun Oct 29 22:23:50 GMT 2006

I have seven appeals running with the Information Commissioner since 
2003 and I received the first decision from her on 10th October.  She 
found in my favour on all 7 records relating to release of tally data.  
I will post this information on fiasco.ie when I receive it.

But I also received the attached letter from her.  Two similar letters 
re case 040103 and case 031018 also arrived.

Her Investigator is now suggesting that Section 23 of the FoI Act will 
be applied to prevent me getting various records because "access could 
reasonably be expected to facilitate the commission of an offence".  The 
offence in question is to "wilfully and without authority interfere with 
any voting system equipment".

Her view is based on the recent hack of the Nedap machine in Holland.


    * The hack did not happen in Ireland. 
    * The hack was done on machines owned by the Dutch group who did the
    * The hack infringed no law in Ireland.
    * In my opinion, no offence was committed in Holland.
    * An offence can only happen if the interference is to "voting
      system equipment" as defined in the 2004 Act.

So the question is - could the information I'm seeking make it easier to 
commit an offence in Ireland?

Bear in mind that the role of the OIC is to supervise the application of 
the law and not to have any opinion on the merits of electronic voting 
per se.

Your comments and ideas would be welcome.

Office of the Information Commissioner

18 Lower Leeson Street, Dublin 2.  Tel: +353 1 639 5689 Fox: +353 1 639 
5674 Web: www.oic.ie


Our Reference : 030197
10 October 2006

Mr Joe McCarthy
52 Claremont Road
Sandymount Dublin 4

 Dear Mr McCarthy

 I refer to previous correspondence from this Office concerning your 
application for a review of the decision of the Department of 
Environment, Heritage and Local Government on your request dated 14 
January 2003. The records the subject of this particular review are 
those in relation to which the Department consulted with third parties, 
further to section 29 of the F01 Act. At the point at which the 
application was made to this Office, the Department's view was that the 
records were exempt under section 27 of the F01 Act, and that the public 
interest did not warrant their release.

 The records at issue in this case are as follows: 

    * Record 2 -The three appendices to the document "Detailed Software
      Design NedapVoting System ESIl ES11-1 i.e. Appendix AI (FUNCTION
      STD), Appendix A21 (ELECTION STD) and Appendix A3 SERVICE STD;
    * Record 31 (j): Integration Tests (Apr 02);
    * Record 31 (k) State Machine Tests (Apr 02);
    * Record 31 (l) Support Function Layer Tests (Apr 02);
    * Record 31 (m) Driver Tests (Apr 02);
    * Record 31 (n) Event Handling Tests (Apr 02);
    * Record 31 (o) Communication Tests (Apr 02);
    * Record 31 (p) Connection Board Function Tests 18-10.-01 Vn 0. l ;
    * Record 31 (q) Display Board Function Tests 18-10.-01 Vn 0.1 ;
    * Record 31 (r) Test Description Vote Storage at Power Failure
    * Record 31 (s) Software Updates 01 .01 to 01.02 (28-09-2001);
    * Record 31 (t) Software Updates 01.02 to 01.03 (19-10-2001);
    * Record 31 (u) Software Updates 01.03 to 01.04 (14-12-2001).

 Scope of the Review

The Commissioner's review decisions are de novo, which means that they 
are based on the circumstances and the law as they pertain at the time 
of her decision. In the High Court judgement in the case of Minister for 
Education and Science v Information Commissioner  -the text of this 
judgement is available at www.oic.ie -Mr. Justice O'Caoimh, commenting 
on the nature of a review under section 34 of the F01 Act, said that 
"importance must be attached to the fact that the nature of the appeal 
agreed between the parties arising under Section 34 of the Act is by way 
of a hearing de novo by the Information Commissioner" and that "the 
decision that was to be made by Information Commissioner in light of the 
appeals taken to him were to be made in light of the facts and 
circumstances applying at the date of the review by him and not those 
facts and circumstances pertaining on the date of the original decision".

 Accordingly, her review will be concerned with whether the Department 
is in accordance with the F01 Act in refusing to release the above records.

 Preliminary Views

 Section 23

Firstly, given the recent hacking of a Nedap machine in Holland, the 
Commissioner may decide that the records at issue are exempt from 
release under section 23(l)(c) of the FOI Act -whereby a record may be 
refused where access to it could reasonably be expected to facilitate 
the commission of an offence.

 This is not to imply that you might commit an offence -however, it must 
be borne in mind that release of information under FOI is akin to the 
release of information to the world at large. It seems to me that the 
key to the application of section 23(l)(c) is not the issue of who might 
commit an offence, but whether the commission of an offence could be 
made easier by the release of the information at issue.

Given that hackers infiltrated the Dutch system using information 
contained in the Commission on e-Voting Report, I am of the view that 
the information in the records under review in this case could 
reasonably be expected to facilitate further hacking. Thus, release of 
the records could reasonably be expected to make it easier to commit an 
offence (a person being guilty of an offence, under section 2(1) of the 
Electoral (Amendment) Act 2004, if they wilfully and without authority, 
interfere with any voting system equipment).

 Significantly, should the Commissioner be satisfied that section 
23(l)(c) applies in this case, the records will remain exempt from 
release to you because section 23(l)(c) does not require the 
consideration of the public interest.

 Section 27

Apart from the prospective application of section 23, it also seems to 
me that the above records contain technical information the release of 
which could prejudice the competitive position of the producers of the 
Nedap voting machines. You may argue that the recent hacking of the 
voting machines in Holland means that the competitive position of Nedap 
cannot be further prejudiced through the release of the above records. 
However, it seems to me that the release of the records would involve 
the disclosure of information not already in the public domain, which 
could indeed further prejudice Nedap's competitive position. 
Accordingly, I would accept that section 27(l)(b) applies.

 You have made a number of arguments in respect of case 031018 in 
particular, and in respect of other applications to this Office, to 
support your position that the records at issue in such cases should be 
released to you in the public interest.

 However, it seems to me that there is a further public interest 
argument to be considered -that of preventing the disclosure of 
information that could facilitate the commission of an offence, which in 
my view, is a very strong public interest in support of the information 
being protected.

 Please note that any comments you wish to make on this view will only 
be considered by the Commissioner, along with other arguments you have 
made in support of the release to you in the public interest of 
commercially sensitive information, if she does not accept that it is 
appropriate to consider section 23 in relation to the records.

 If you wish to comment in relation to this letter, please do so by 2 
November 2006. Any comments made by that date will be taken into account 
by the Commissioner in her decision, which will issue as soon as 
possible thereafter.

 Yours sincerely



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.stdlib.net./pipermail/e-voting/attachments/20061029/7abcd099/attachment.html

More information about the E-voting mailing list