EVA – the electronic election administration system

EVA, the electronic election administration system, is the key IT system used by municipalities and county authorities for preparing for and conducting elections.

Published:

In short, municipalities, county authorities and the Sami Parliament register all the information relating to the practical conduct of the election in EVA. This includes, for example, registering whether the election is a one-day or two-day election, which polling stations will be used, polling station opening hours, etc. The parties standing for election and the parties' candidates are also registered. Finally, everyone in the electoral register is registered in EVA in a collaborative process between the Norwegian Directorate of Elections and Norwegian Tax Administration.

The information is used as a basis for producing ballot papers and polling cards, as well as for determining how EVA provides system support to municipalities and county authorities for the reception of votes and counting of election results.

EVA is the main system for conducting elections, and machine counts of ballot papers are input automatically. In the event of manual counting, they must be input manually. The information held by EVA is also used as a basis for calculating forecasts and election results, which are published on valgresultat.no and provided to the media on election night.

The Norwegian Directorate of Elections uses EVA as a basis for reporting and as source information to provide municipalities and county authorities with the best possible support and assistance to ensure that elections are conducted properly and securely.

The Norwegian Directorate of Elections grants access to two people in each municipality, county authority, and the Sami Parliament. These are the election officers who bear local responsibility for the practical conduct of the election. They provide the necessary access rights to election officials in their municipalities and county authorities, which are restricted based on the functions they will perform.

The Ministry of Local Government and Modernisation also has access to the system so it can fulfil its role as secretariat for the national electoral committee.

The Norwegian Directorate of Elections also has access to EVA and the information municipalities, county authorities, and the Sami Parliament have registered. Access rights in the Norwegian Directorate of Elections are also restricted based on the duties of the various employees.

Most of the data registered in EVA is public information that is neither confidential nor sensitive personal data; it is also data the Norwegian Directorate of Elections shares with other stakeholders.

There are two exceptions:

  • Electoral register

    This is the register of everyone who has the right to vote in the relevant election. The 'crossed-off' electoral register is not public information. The electoral register is public prior to its being 'crossed off'. The municipalities will publish a paper copy of the electoral register for public scrutiny. This will remain public up to and including election day.

  • Election results before 21:00 on election day

    Results from counts must not be published before all polling stations have closed to ensure no one is influenced.

EVA Admin is secured at several levels and the security mechanisms for access to the system are verified by the Norwegian National Security Authority.

Examples of security measures that have been implemented:

  • Traffic to EVA is monitored and registered
  • Who has access to EVA and which functions they have access to are restricted
  • Access rights to EVA can be revoked by the Norwegian Directorate of Elections
  • Those with access rights must identify themselves via the ID Portal (BankID, Buypass, etc.).
  • The actions of those with access are logged and can be followed up in the system.

In addition to securing the EVA IT system, safeguards have been integrated into the electoral process that ensure that compromising IT systems is in itself not enough to influence election results – the safeguards do not depend on whether an IT solution is used or which one is used.

Furthermore, much of the information held in EVA is also available elsewhere and, therefore, can be verified:

  • Information about county authorities, municipalities, and constituencies is held by the Norwegian Mapping Authority.
  • The electoral register is held by the Norwegian Tax Administration.

The physical ballot papers will be held by, and available from, county authorities after the election.

In sum, this means that EVA largely just collates and organises information in an efficient and reliable manner to ensure that elections are conducted properly and securely.

EVA is administered in close consultation with the municipalities and county authorities. They help to define its desired functionality and actively contribute to user testing the system. This is additional to its own thorough testing that takes place on several levels: legality testing, automated functional testing, integration testing, performance testing, and vulnerability, security, and penetration testing.