Swiss Post’s internet voting system has been subjected to over 60,000 attacks by around 3,400 hackers. The “bug bounty” intrusion test was conducted between 8 August and 2 September 2022. The organisers encouraged ethical hackers to find security flaws and weaknesses to help developers refine the voting system in preparation for renewed public trials. Rewards of up to €30,000 for the discovery of serious security flaws.
Swiss Post aims to make the platform available to interested cantons at some point in 2023. This would mark the first use of online voting in Switzerland since the last round of trials was ended in 2019 due to security concerns.
According to a study conducted by Deloitte in December 2021, 84% of the Swiss public consider it important that they should be able to vote online. The country boasts the most advanced legislation in the world on its implementation, there nonetheless remain important legal questions that need to be addressed before trials can continue.
Bug Bounty: Encouraging Results
During the bug bounty intrusion test, ethical hackers were invited to target the e-voting system’s infrastructure, or “outer protective shield”. They were provided with sample voting cards, allowing them to try out the voting procedure in full, following the exact steps voters will use in potential future elections and votes. Anyone wishing to take part could do so, after agreeing to a code of conduct.
The results of the intrusion test were encouraging: no hackers succeeded in breaching the system. Swiss Post verified just one finding which emerged from the intrusion testing, which was not relevant to the system’s security, but will help developers to streamline the system. A reward of 500 Swiss Francs (approximately €520) was paid out.
Resumption of Testing
The bug bounty was part of a broader set of security tests that Swiss Post’s latest i-voting system has been undergoing a series 2021. The source code for the platform was published in February 2021, allowing experts from around the world to scrutinise it for potential flaws. If they succeed in readying the system for trials in 2023, this will still mark a four year hiatus in i-voting trials – the longest gap since they first started in 2004.
Switzerland began passing legislation to clear the way for i-voting in 2003, making it one of the first countries in the world to do so. Since 2004, 15 Swiss cantons have conducted more than 300 trials – more than any other country.
Delays to Swiss i-Voting
In 2017 and 2018, the Swiss authorities began setting out conditions for the permanent introduction of i-voting. Crucially, legislation stipulated that any system would need to meet new verifiability conditions that had not been required of previous iterations. This “complete verifiability” meant that individuals must be able to verify that their vote had been counted correctly, and that auditors receive proof that the results have been obtained correctly.
Swiss Post presented a system intended to fulfil these criteria, submitting it to intrusion testing and publishing the source code in February 2019. In March of that same year, independent researchers discovered a serious flaw in the source code which would allow a system administrator to alter votes undetected. Swiss authorities responded by discontinuing trials with the Swiss Post system, and that June, the Federal Council provisionally abandoned plans for the permanent introduction of i-voting as a regular channel, and set about reframing the conditions for further trials.
The latest round of legislation on internet voting was passed in June 2022, setting new conditions for the resumption of trials. The legislation includes the requirement that any i-voting system be subjected to a permanent bug bounty programme, and that the source code be made public. It also limits any trials to 30% of the cantonal electorate, and 10% of the national electorate (though overseas voters and voters with disabilities are exempted from these limits).
At present, Swiss Post is the only provider working on a new i-voting system, after the canton of Geneva abandoned its own system in 2019, citing rising costs.
Legal Questions Remain Open
The latest round of legislation concentrated on the technical criteria a system needs to fulfil before it can be used in trials by the cantons.
Yet there are several major legal issues which would need to be resolved before e-voting can be introduced on a large scale. For example, Swiss law guarantees ballot secrecy — a basic condition for any functioning democracy. It is unclear how this secrecy can be safeguarded in the context of internet voting. Software can certainly be designed to preserve the anonymity of voters during the verification process, but this does nothing to address the fact that user devices are intrinsically vulnerable to hackers and malware. The voting system itself may be secure, but the laptop or mobile phone someone is using to cast their vote is another matter entirely.
Ardita Driza Maurer is a legal scholar specialising in the legal implications of e-voting and digital solutions throughout the electoral cycle as well as in issues of citizen participation. She believes that Switzerland urgently needs to hold a discussion of the broader set of legal questions surrounding i-voting be held, including the issue of ballot secrecy. She points out that discussions along these lines took place in 2002 – when Switzerland first launched its e-voting programme — but they have not been repeated in the intervening years. She told Democracy Technologies:
“Swiss legislation on e-voting is certainly the most advanced in the world. Nonetheless, at this stage, we need to have a thorough discussion to bring together the requirements from a legal perspective with what is proposed from a technical perspective, and get these two sides into a dialogue with one another.”
Support among Overseas Voters
Particular pressure has come from the more than 884,000 Swiss citizens living abroad – currently relying on postal votes to cast their ballots.
The Organisation of the Swiss Abroad has repeatedly called for a return to i-voting, citing a decline in turnout among Swiss citizens living abroad since trials were discontinued in 2019. The situation was exacerbated by the Covid-19 pandemic, during which thousands of postal ballots arrived late due to worldwide postal service disruptions.
A spokesperson for Swiss Post told Democracy Technologies:
“Surveys show that today’s voters would like to make use of electronic voting. While previous generations over the last thirty years considered postal voting practical and straightforward, today, ever more people are calling for an additional channel for voting – the possibility to vote digitally. […] The younger generation expects that everything can be done on a smartphone. It is inconceivable that this should not also apply to political voting rights in the near future.”
