A team of researchers and Swiss Post have notified the Federal Chancellery of a further flaw in the new e-voting system. The flaw concerns the system’s individual verifiability, which enables voters to check that the system has correctly registered their vote. Individual verifiability is a key element of Swiss Post’s existing e-voting system already in use in four cantons (BS, FR, NE, TG). The Federal Chancellery considers the decision on the part of Swiss Post not to make its system available for the vote on 19 May to be logical under the circumstances. The e-voting system operated by the Canton of Geneva is not affected by this flaw; the six cantons using that system (AG, BE, GE, LU, SG, VD) have therefore been authorised to use it for the vote on 19 May.

The Federal Chancellery has no indication that these flaws have resulted in votes being manipulated in previous ballots.

Federal Chancellery to conduct a review

Swiss Post’s new e-voting system, which in addition to individual verifiability is also supposed to guarantee full verifiability, was subjected to a public intrusion test between 25 February and 24 March. Swiss Post released the system’s source code prior to the test. The Federal Chancellery is satisfied that these measures have led to the discovery of weaknesses and allowed important findings to be made. As already announced on 12 March, the Federal Chancellery will conduct a review. This will take into account the results of the test as well as the flaws identified by researchers from the documentation and the source code.

A total of 16 responses to the intrusion test were classified as breaches of best practice. However, they do not constitute major risks. The results of the intrusion test can be found on the website of the external provider that organised the test on behalf of the Confederation and the cantons.

Federal Chancellery to review e-voting