2. Is the SecurePoll extension already installed on Wikimedia wikis by default?

Yes, apparently it is. See https://github.com/wikimedia/operations-mediawiki-config/blob/bb0fb0d6812624e8a95d84ad7ac5206b31cef5ab/wmf-config/InitialiseSettings.php#L10579-L10583

Edit: I checked a couple of Wikipedia's and didn't find an instance without SecurePoll. It seems to be installed everywhere, but I can not tell if it is set up everywhere (e.g. serverside requirements like gpg). But guessing from the public available config, I'd say yes.

1. Is the method for connecting local wikis to votewiki likely to complicate this? Could you for example make a local election but also allow that wiki to take part in global elections? That is not clear to me.

I did some additonal investigations. Here are my findings so far.

The securepoll_lists database table is the source of the "eligible users".

The "votewiki hosted election" or "global election" usecase roughly works as this:

1. On each wiki that participates, a new DB table is added and then populated by populateEditCount
2. On an arbitrary wiki makeGlobalVotesList walks all the wiki instance DBs and compiles the data from populateEditCount into the securepoll_lists table of votewiki
3. makeMailingList, deduplicateMailingList and sendMail are used to notify users that are listed in securepoll_lists

The "local election" usecase roughly works as this:

1. After the poll has been created, the securepoll_lists table can be populated ...
   1. ... either by a plain list of usernames
   2. ... or by a "rule based selection" from the wikis local user base (PopulateVoterListJob)
2. No notification is being send out to the eligible users

In both cases tallying is performed in the same way. A "global election" is probably much bigger than most "local elections" an therefore more time consuming at the tally.

As far as I can tell from the publicly available configurations, neither the securepoll_lists table, nor any other from Extension:SecurePoll is shared between the various wikis. So every wiki has its own, independent SecurePoll database tables. Therefore it can run elections independently from "votewiki". In the "global election" case we use a completely different path to populate the securepoll_lists table ot "votewiki". But that doesn't interfere at any point with the regular ("local election") functionality.

tl;dr
No, the method for connecting local wikis to "votewiki" does not conflict with having elections on the local wiki itself.
So yes, a wiki can host "local elections" at the same time it participates in a "global election".

3. Are there any other Security ramifications to consider?

For my part, I can not see any.

Thanks @Osnard :) This is extremely helpful.

So it sounds to me like there isn't actually anything to technically change here. We might even be able to test this out immediately. I would be happy to dig into that on testwiki, as a local instance of SecurePoll... except that testwiki does not have electionadmin as a userright, so you can't actually do that because of T290808...

Prior to the revoking of testing on testwiki, I did do a local testwiki only election test, from what I recall it was fine.

Suggestion: On sites wish to setup their own election (for now I think there's enwiki, fawiki and zhwiki?), create the group electcomm and electionadmin (or probably we could merge these two groups, as it's reasonable for the person who setup the election electcomm also act as a scrutineer electionadmin). Candidates should pass some sort of community discussion to be in this group, and it should only be granted and removed by steward, when the candidate has signed the NDA. This imo could solve the issue addressed in T290808. From another view, we do have checkuser group on testwiki, and it is fine to grant to somebody when they were approved by the security team to test checkuser extension.

In T335201#8809056, @jrbs wrote:

Thanks @Osnard :) This is extremely helpful.

So it sounds to me like there isn't actually anything to technically change here. We might even be able to test this out immediately. I would be happy to dig into that on testwiki, as a local instance of SecurePoll... except that testwiki does not have electionadmin as a userright, so you can't actually do that because of T290808...

electionadmin was added back to testwiki in https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/1036633, if someone wants to do some testing.

To be very clear, testwiki still collects and makes available the private data to the poll's election admins, so who can use this is still sensitve.

In T335201#9857572, @Xaosflux wrote:

To be very clear, testwiki still collects and makes available the private data to the poll's election admins, so who can use this is still sensitve.

Seconding this, we had an incident exactly because of this a couple years ago.

In T335201#9858546, @Ladsgroup wrote:

In T335201#9857572, @Xaosflux wrote:

To be very clear, testwiki still collects and makes available the private data to the poll's election admins, so who can use this is still sensitve.

Seconding this, we had an incident exactly because of this a couple years ago.

This is no longer the case now after r1083337 / T377531