Hackers find only minor issues with Swiss Post’s e-voting system

For certain groups, including Swiss citizens living abroad, e-voting is an important issue. Keystone / Gian Ehrenzeller

A recent public test of the Swiss Post’s electronic voting system, involving 7,000 ethical hackers from around the world, found four reported vulnerabilities, of which only one – of “low severity” – was confirmed.

Swiss Post said on Thursday that during the test period, which ran from June 17 to July 3, attacks were registered from 6,923 IP addresses from 62 countries.

The aim of the test, which was run under the same conditions which are used for real elections and votes, is to uncover possible security flaws.

Only one vulnerability (of “low” degree, on a scale that also includes “medium”, “high” and “critical”) was found, Swiss Post said. It was not a security-relevant issue, but a suggestion to improve communication between servers to prevent simultaneous searches. Swiss Post has already updated its software accordingly.

The hacker who uncovered the flaw pocketed a prize of CHF4,500 ($5,242): CHF1,500 for the notification plus a CHF3,000 bonus for being the first to report it.

The prizemoney however amounted to a meagre haul compared to what would have been awarded if somebody had managed to breach the system seriously: a discovery of critical vulnerabilities would have meant a booty of CHF50,000, while managing to manipulate the electronic ballot without leaving a trace would have meant CHF250,000.

Adapted from Italian by DeepL/dos