Stéphane Adamiste, an auditor of Switzerland’s electronic voting (e-voting) system, explains how the infrastructure and operations of Swiss Post, the cantons and print offices are examined under the 2022 ordinance on electronic voting. Drawing on audit findings, including a regression in physical access controls for the critical control components, the speaker assesses malware, denial of service (DoS), print-office and state-actor scenarios. He argues that risk-based thinking, complete verifiability and defense in depth matter more than black-and-white judgments, and that organizational gaps rather than sophisticated cyber attacks are the most likely source of future incidents.

Video chapters

• 0:00 Introduction and talk outline
• 1:15 History of Swiss e-voting trials
• 3:19 Redesign and the 2022 ordinance
• 5:24 Audit scopes and examination criteria
• 10:07 Audit findings and residual non-conformities
• 13:39 Regression in control component access
• 15:45 Data flow and malware threats
• 21:40 Denial of service, print offices and state actors
• 25:52 Takeaways on e-voting security
• 29:05 Questions and answers

Key facts

• Switzerland has run e-voting trials since 2004, with more than 300 trials over 20 years.
• The ordinance on electronic voting, in force since 2022, makes complete verifiability, examinations mandated by the Federal Chancellery, a bug bounty program, and publication of source code, documentation and audit reports mandatory.
• The ordinance's annex defines four audit scopes, with 124 criteria for Swiss Post, 172 for the cantons and 45 for print offices, and a minimum catalog of 38 threats for risk analyses.
• The speaker's first full audit of Swiss Post found 25 non-compliances, which took three follow-up rounds to bring to a satisfactory level.
• The four control components require a two-person rule and segregation of access between components; the speaker found these rules unimplemented after a reorganization and they were fixed during the audit.

Ideas

• Individual verifiability lets voters detect vote manipulation by malware: return codes are delivered out of band on the voting card, so malware cannot predict the code that confirms an unaltered vote.
• Many residual non-conformities stem from a strictly literal reading of the ordinance, such as requiring recognized certificate suppliers where parties actually use a direct trust model by exchanging certificates in person.
• Print offices may look like the weakest link because they are small and depend on equipment suppliers, yet their experience printing secure documents and the fact that everybody knows everybody make intruders likely to be detected.
• Risk ratings for state-sponsored manipulation should consider motive and relevance: easier ways to influence Swiss votes exist, and e-voting results are checked for plausibility against other voting channels.
• A vulnerability is not an attack; the hard part for an adversary is changing votes at scale without being detected.

Keywords

• e-voting
• Ordinance on electronic voting
• auditing
• Swiss Post
• governance
• plausibility

Quotes

• “It tells me that it's really important to keep my eyes open.”
• “It's possible, but how do you then change the votes without being detected?”
• “They mostly stem from human error not from attacks.”

Recommendations

• Draw a data flow diagram mapping threat agents and data flows when assessing the security of an information system.
• Treat e-voting security as risk-based, reducing risk through defense in depth rather than rejecting a system because a vulnerability exists.
• Re-verify previously fixed controls in recurring audits, especially after reorganizations, since the speaker observed a regression in physical access controls (inferred from the audit finding).

Resources

• Ordinance on Electronic Voting (annex of examination criteria) — Framework — Forms the basis of the audits described and specifies the 38 threats that risk analyses must cover at minimum.
• Swiss Post e-voting publications on GitLab — Website — Provides public access to source code, specifications and documentation, including the voting protocol with its computational proof.