Rop Gonggrijp: Estonian Security Community is Ignoring the Risks of Attacks on Elections

Rop Gonggrijp, an international cybersecurity expert and one of the leading figures behind the organisations that campaigned to end electronic voting in Germany and the Netherlands between 2006 and 2009, was interviewed in late spring 2025 by Martin Ehala, a journalist and opinion editor at Postimees.

How did you get rid of e-voting in Holland and Germany?

We used voting computers in polling stations, not over the Internet, because the Internet didn’t exist yet. In Holland, that was almost completely 100% machines. Amsterdam was one of the very last cities to switch to machines in 2006.

It was so-called black box voting. There was no physical record of the vote of any kind, nothing that the voter could inspect. You just had to trust the software to count the votes correctly. I became involved and said no, because I knew that this was the worst kind of electronic voting machine. We started campaigning against their use, which wasn’t particularly successful except in a small community of people who understood the technology.

In Holland, at that time, the technology community was not invested in this idea of the government being the most modern like in Estonia. For the technical community, the idea that this was a closed source machine that people would vote on, and you just had to trust the software, was so instantly appalling that they were very much against it from the beginning of our campaign. It was very easy to convince them.

How did you convince the wider public?

First, they promised to make the software open source. I explained that you can’t trust even that the open-source software is in the machine that’s in front of you. Then I realised that you can’t actually improve this system. People can’t understand what’s going on in this computer. People can’t see electrons. You can never map a system where people can see the ballots to a system where people cannot see what’s going on, and have it to be just as transparent, have it to be just as trustworthy.

But America still uses it or is there a different system?

It is different. All the voting machines in the US are ballot machines. They scan paper ballots or they fill out paper ballots, so you have something to count afterwards. They had black box voting where you just trusted the software, and those black box voting machines are all been replaced with the exception of a few counties, I think.

So now they have a safer system.

Well, the thing is, it’s only safe if you actually count the ballots. But the idea that you can count if the election is close, is something that is typical for a two-party system. In the two-party system, you have the concept of a close election. So you can increase your scrutiny as the election becomes closer. You don’t need to recount ballots in a precinct where the Republicans win by 75%. If you have coalitions and majorities, like in many countries in Europe, every election is close because you don’t know what the majority is going to be.

And the American elections are fairly complex because you’re voting for 40 different offices and 40 different questions on the ballot. It’s like voting in 40 different referendums and 40 different elections all at the same time. In the American context, I can understand the use of voting machines, but in the Dutch context, I cannot. It just simply doesn’t make sense.

But still, how did you convince the wider public?

Our campaign wasn’t particularly successful with the general population until we managed to buy an old voting machine from a municipality that had merged with another one. We took it apart, figured out how it worked, and wrote software for it that lied about the result. We showed: “Look, we just do an election for you on our own machine. We just run the whole election and now you can see that this election, even though we saw that this candidate got 5 votes, and that candidate got three, the candidate with three votes now wins on the election results.” We just showed them that it was easy for the machine to lie about the results.

And this was decisive?

No, it took six court cases, we did our own investigative journalism, we wore many different hats. We were scientists. We wrote a famous paper about the machine. We wrote a scientific paper. We did journalist work. We were involved in politics. We lobbied politicians. We wore all the different hats that you can wear in a country.

Funnily enough, we discovered several problems that I call typical small-country-problems, where people wear lots of different hats, and they meet each other all the time in the same cafes. As they still must all be able to go to the same cafe they cannot effectively confront other people, and they have friends in common. This supresses criticism.

Was the machine-voting issue politicized, as in Estonia? Were there certain parties who were for and others that were against?

Well, we have what we call the Liberal Party, the pro-business party. They wanted to move very quickly towards Internet voting. Lot of the Dutch expats vote for them, but need to use mail voting. If they could raise the expat vote in internet voting, they would get an extra seat or even two. They wanted technology - technology is good; we can’t be doubting technology because there’s one or two extra seats in it for us.

Other than that, I think most politicians, once our findings became public, were honestly aghast and shocked and wanted to get rid of these machines as soon as possible. The ministry wanted to keep it around because they were dealing with the municipalities, who are the actual organizers of the election. The central government only provides legislation and support, but they do not, in fact, organize the elections.

So there was the managerial kind of simplicity argument involved?

From the eyes of the municipalities, the voting machine solved a lot of problems. I can understand because you no longer have the fight over whether this is a valid mark or not a valid mark. All these disputes go away because there’s just a simple unambiguous little cash register printout from the voting machine and no disputes. Very importantly, the members of the voting committee, in other words, the polling station workers, get to go home a few hours earlier. From the viewpoint of the municipalities, this was a wonderful system.

But anyway, so we got rid of the machines in Holland, and in Germany, the same machines were in use, but they were only just coming in. We campaigned together with the Chaos Computer Club, a very powerful group of hackers that became a political powerhouse. Based on what had already happened in Holland, we essentially said everything these people have ever said is wrong and it can be proved to be a lie. And we wrote a study that was just devastating.

Was the machine the same in principle?

The same type of machine, same manufacturer, slightly different version because the German election system is slightly different. So the German constitutional court was giving their verdict, we arrived in Karlsruhe, where the court is, and the ministry was there, too. They assumed they would probably need to change the law a little bit here and there, but surely, the machines will remain. Then, somewhere in the third paragraph, the chair of the court says that the applicable legislation covering these machines is taken out of electoral law without replacement. And it is effective immediately as of that day.

So, it was your total victory?

Of destruction, the E-voting in Germany became a smoking crater. And not only that, but the court said the voter has the right to be present for the count of the votes at the polling station. For that right to be meaningful, the voter can’t be confronted with a machine that just says this is the result. To make the verdict technology-independent, they said the following: any vote should be understandable by someone with just a regular high school education, without any delegated trust. This means the voter should not have to delegate understanding to other people but should be able to comprehend where the result comes from on their own. This requirement eliminates cryptography and computer software, as understanding the process must happen in front of you. If a regular German, who has been in school for 12 years, cannot understand what happens before their eyes, such technology is not valid for the use in elections.

The court essentially defined a new constitutional right. It was based on the right of free and fair elections. And they said, as part of that constitutional right, you now have the right to understand what happens in front of your eyes, because apparently we need to define a right to understand what happens.

The same with-your-own-eyes argument applies to the Estonian e-voting system as well, but the Estonian higher court has not seen it as a violation of free and fair elections as did the German Constitutional Court.

It’s very important to understand one thing: the Estonian computer security community, small as it is, is very out of step with the international computer security community when it comes to electronic voting. You cannot, for the life of you, find experts that are willing to say that electronic voting is a good idea anywhere else but in Estonia.

Why do you think the Estonian cybersecurity community is so out of step with the rest of the world?

Because they drink the Kool-Aid of Estonia being this totally modern new kind of state that is all on the Internet and all digital. And in many ways that is actually a good idea. There’s plenty of ways in which being online and digital, especially for a country like Estonia, is a wonderful idea. I am very much pro E-government. And it’s wonderful that you have this ID card and that you can do all this stuff online. I wish Germany was that way in so many ways. I wish Germany was as modern as Estonia. It’s just not a good idea for voting.

But do you think this is a part of the small country problem, that we couldn’t change our minds about e-voting in Estonia?

I think you will have serious trouble finding work in Estonia in government IT or in big IT projects or IT consulting, or IT anything if you are against this electronic voting project. But let me switch the context a little bit. I think none of it matters much in the Estonian context of 2025, because of changing geopolitical situation.

In what sense, please elaborate.

The hybrid warfare of today makes elections the number one battleground. I think the Russians hate the fact that NATO has harbours that close to Petersburg. If they can scare NATO away they would. Spending, say, 50 million or 100 million on attacking the elections in Estonia, where you already have a Russian minority that sometimes rightfully thinks they are oppressed, might be useful. Because a government cannot be more trusted than the elections that got it there. Therefore, attacking the trust in the election is often, as we see in Russian strategy since Brexit, through conspiracy theories or not, is a primary battleground in the wars of today. I’m not saying that they could do this on the Internet only. I’m just saying that they could tremendously magnify their look. There will be some kind of dumb bust situation, and there will be some kind of border skirmish…

But now the standard answer for this criticism is that you are right now doing Putin’s work – attacking the trust in our elections. And that’s why we shouldn’t criticise e-voting, because that undermines the legitimacy of our e-voting system.

The voting system must be trustworthy. To be trusted and to trust a system that is not trustworthy simply because the alternative would be to help the enemy is just delaying the problem. Look, everything we do in computer security have threat models - what are we defending against? What is the threat? Who do we think the threat is? And how do we defend against? What is our adversary capable of? A state with an advanced offensive cyber capability, which is Russia, is the worst case. There are only a few parties—Russia, China, America, and maybe Israel—that have offensive cyber capabilities in that class. If your adversary is in that group, you have the worst possible computer security problem.

But our cyber community says that the adversary actually can’t change the result. How could you convince you that you are not just a crazy conspiracy theorist?

I just say that there is a real threat. If there is ever a geopolitical tension, then the ability to mess with Estonian elections is going to be very valuable. Do you know the shell game? It’s played all over the world, usually by criminal gangs. On the street, it’s three cups and a ball. It’s one little ball and three cups. Trust is like a shell game – wherever you look under a cup, there’s no blind trust there. Look, you can see everything, but the blind trust is always under one of the other cups. This trust is blind because you can’t actually see what’s going on. So, you have to project, an observable system onto a system that is not observable. And this is a fundamental problem, because the bottom system can always mess with everything that’s on top. So, there’s always blind trust in any voting system or electronic voting system or Internet voting system. There’s always blind trust. There’s no full observability possible.

I can understand your argument. But it does not change the minds here In Estonia. You have a lot of experience as an activist. Do you have any idea what should be done to get rid of this unobservable system?

Well, first and foremost, you need to find technologists that are willing to say, “Look, all this E-voting and Internet stuff is all wonderful. This whole digital government is wonderful, except for voting.” You know, you don’t want to seem like a Luddite. You don’t want to reject technology. This was the problem in Holland. There had been other critics of electronic voting, but they were painted by the government as being technology critics. And some of them actually were, so they were painted as, “Yeah, well, listen, grandpa, you don’t really understand how this whole new technology thing works, and the world is changing. You know, it’s not all staying the same.”

They couldn’t do that with me because I had brought the Internet to the country. I was known as the Internet pioneer. So I was Mr. Modern Internet. For them to say, “Well, you don’t really understand this technology,” I would turn around and say, “You are a bunch of lawyers in the ministry. You don’t understand the technology. You just believe everything this vendor has told you.”

Yeah, the thing is, what I have got an impression of is that not many tech specialists, who want to get into the issue. I mean, they don’t want to take a stand and say, “Oh, that’s wrong.” I mean, somehow it seems…

… a small country problem. But ask Professor Alex Halderman. He was in Tallinn studying the Estonian voting system around ten years ago. He’s a good friend of mine. We, together, researched the Indian electronic voting system. Ask him.

The IT Guy Can’t See the Log in His Own Eye?

Preface to the interview published on 17 January 2026 in Valija Hääl

I had known of Rop Gonggrijp by name and was familiar with his work for a long time, but I first met him in late 2023 at the Chaos Communication Congress, Europe’s annual hacker gathering, where he was among the audience for my presentation. When he approached me afterwards seeking further information, his message was serious: he and his colleagues from Germany’s information security community were concerned that Estonia, a country on NATO’s eastern flank, was experimenting with an obvious security vulnerability such as Internet Voting.

Following Halderman and his team’s tour de force during the 2013 local government elections, little reliable information about the state of our experiment had reached the outside world. The summary of my observer report provided technical context based on first-hand experience. My presentation was essentially a data-driven account without a strong political message, offering a snapshot of organisational instability, certain inconsistencies in the system’s architecture, and the fictionality of its practical operation.

Gonggrijp’s conclusion, however, was unequivocal: if Estonia cared at all about genuine cybersecurity and its own and Europe’s security, we should burn the system with fire, bury the remains in the desert, and erase all memory of where it was ever buried.

This is how our Internet Voting is viewed by a cybersecurity professional who genuinely cares about security, rather than someone living in a provincial bubble of self-deception. His work and life are connected to major corporations and clients in a major industrialised country, whose responsibilities extend beyond grand statements to the practical protection of assets of global importance. Yes, there are also a number of less responsible academic cryptographers, voting technology developers and predominantly grey-hat or black-hat hackers in other countries who find it interesting to see where Estonia’s experiment leads.

But do we really want to be useful idiots for experts pursuing excitement or personal gain – or for the twists and turns of history?

On 20 June 2025, Postimees published an interview by Martin Ehala with Dutch activist, hacker and cybersecurity expert Rop Gonggrijp under the headline “Rahvusvaheline digiturbe aktivist: e‑hääletust usaldatavaks muuta pole võimalik” (“International Digital Security Activist: There Is No Way to Make E-voting Trustworthy”). With the authors’ permission, the social media publication Valija Hääl published the original, unabridged version of the interview, in a new translation by Andres Aule, on 17 January 2026. Since the text was not readily accessible without a paywall or outside Zuckerberg’s fiefdom, I decided to republish it on my blog. The header image is a fragment of a photograph by Sebastiaan ter Burg, licensed under CC BY-SA 2011. My personal preface to the interview’s publication in Valija Hääl can be found on Zuckerberg’s network.