Secrecy and security for web forms is usually provided in the web industry by using HTTPS (Hypertext Transfer Protocol over Secure Socket Layer), which encrypts the data. This is very standard in the industry, and any competent web company can easily deploy this. Is there any good reason why this was not done for the NEC election?

It appears voting has been contracted to Popularis Ltd, who claim on their website that:

On line systems are provided for Popularis by its partner, Everyone Counts using end-to-end encryption of ballots as the basis for security

However for the NEC ballot Popularis appear to have sub-contracted out internet voting to Kenda Electronic Systems Ltd, who do not use end-to-end encryption at their NEC e-voting website http://www.kenda.co.uk/labourparty/ or for the actual vote made by a HTTP POST operation to http://www.kenda.co.uk/labourparty/page1all.php? Why? Companies House records Kenda's sole Nature of Business as "Manufacture other electrical equipment" - so they do not seem to claim expertise in electronic voting.

Does anyone know the rules laid down by the NEC for e-voting standards? The Rule Book does not go to this level of detail, and I cannot find anything more specific online. For the Leader/Deputy Leader election the NEC stipulated "secure e-voting", and I'd expect a similar standard for the NEC election.

If your ISP forces a mandatory HTTP cache on users, as AOL does, then your membership number and votes may for a while be stored on your ISP's computers. Another reason why HTTP is inadequate for a secret ballot in my view.

In principle, because of the lack of encryption, it would be possible to alter the votes during transfer. Or vote again later using your details changing or invalidating your vote. I doubt anyone would bother, but for simple technical change of using HTTPS, this possibility should not be open.

This all looks very shoddily done to me.