What IT infrastructure will Swiss Post use to operate its future e-voting system and what security precautions is it taking to prevent operational downtimes or to deal with cyber attacks? What technical solutions does it use to implement the federal requirements for electronic voting? What methods does Swiss Post use to develop its system and how does it test it? Detailed answers to these questions are provided in the four documents published as part of the system disclosure: architecture documentation, infrastructure white paper, software development documentation, test concept.
System architecture and IT infrastructure
E-voting systems must meet high requirements in accordance with federal legal provisions on security, reliability, voting secrecy and verifiability. These form the framework for the system architecture. The documentation on the system architecture describes and analyses the provisions for e-voting in Switzerland and shows how Swiss Post implements them at a technical level.
The IT infrastructure is redundant in order to ensure robust and fail-safe operation during e-voting. For this purpose, the systems are run in two data centers at different locations and also run identically in two different rooms at a single location. In addition, the e-voting system is set up separately for each canton, which means that it has a completely independent environment. These and other precautions built into the infrastructure ensure that a failure caused by a malfunction in the system or by an external cause such as an environmental incident or a criminal attack can be compensated for and safe operation can be guaranteed.
Documentation software development and test concept
Swiss Post is developing the e-voting system using agile project management. An interdisciplinary team works together and develops the project step by step in successive stages. The exact procedure, the specific quality control measures for e-voting and the tools used are described in the software development documentation.
The development of the e-voting system also includes the public review and other tests. The test concept describes the entire procedure, including the test objects, the infrastructure used, the reporting and the test organization.
You will find further information and links to the documents on the e-voting community website.
The latest news from the e-voting community programme
Swiss Post has been disclosing its e-voting system in stages on an ongoing basis since the beginning of 2021. In the coming months, it will also start a permanent public bug bounty programme and an Internet test. These methods of public scrutiny are part of Swiss Post’s cybersecurity strategy. The goal is to use public scrutiny to find and remedy weaknesses that cybercriminals might exploit for attacks at an early stage.
- Since the start of disclosure in January 2021, Swiss Post’s experts have reported around 20 findings. Based on these, Swiss Post has implemented various improvements in the disclosed objects, including in the cryptographic protocol, a new version of which was published at the end of June.
- At community events, Swiss Post’s e-voting team will present specific aspects of the system and provide opportunities for questions and discussion. Experts from all over the world visited the first expert webinar on “Security by Design in the new e-voting system”.
