We have just published a 5-part series on Freedom-to-Tinker about the expert assessments Switzerland commissioned of its E-voting system. https://freedom-to-tinker.com/2022/06/27/how-to-assess-an-e-voting-system/
Andrew Appel, How to Assess an E-voting System
After small-scale pilots of an Internet voting system for citizens living abroad, Switzerland commissioned expert studies of all aspects of its e-voting system: cryptographic protocol security and privacy, systems security, infrastructure and operation, network infrastructure security. These are the most thorough and expert studies ever commissioned of a deployed Internet voting system. Based on these studies, the Swiss government put a pause on further use of the system.
https://freedom-to-tinker.com/2022/06/28/how-not-to-assess-an-e-voting-system/ How NOT to Assess an E-voting System ] , by Vanessa Teague The Australian state of New South Wales used an Internet voting system very similar to the Swiss one. Not only did they whitewash findings by outside experts that the system was insecure, but on election day the system simply didn't work: the Electoral Commission estimated that 20,000 people registered to use iVote but did not receive a voting credential in time to vote; as a consequence, the Supreme Court of NSW voided the results in three local elections. The NSW government has been careless about driver's license security, health data privacy, and covid-tracing records, too: there's a pattern.
[ https://freedom-to-tinker.com/2022/06/29/how-the-swiss-post-e-voting-system-addresses-client-side-vulnerabilities/ | How the Swiss Post E-voting system addresses client-side vulnerabilities ] , by Appel The two biggest vulnerabilities in any Internet voting system are: server-side (from insiders or attackers who penetrate the server), and client-side (from attackers who manage to install a fake voting-app on voters' computers or phones). We explain how the Swiss system protects against client-side attacks, based on a sheet of paper mailed to the voter containing special codes for the voter to enter and check.
[ https://freedom-to-tinker.com/2022/06/30/what-the-assessments-say-about-the-swiss-e-voting-system/ | What the Assessments Say About the Swiss E-voting System ] , by Appel The assessments were commissioned in 2021-22 after independent experts (not commissioned by the government) had found serious security flaws in the cryptographic protocol. The vendor of the system, the Swiss Post, cooperated by documenting the protocol and the computer code in great detail. The assessors found that "the clarity of the protocol and documentation is much improved [which] has exposed many issues that were already present but not visible in the earlier versions of the system; this is progress. ... [but] Several issues that we found require structural changes..."
The glass-half-empty cryptographic protocol experts concluded “We encourage the stakeholders in Swiss e-voting to allow adequate time for the system to thoroughly reviewed before restarting the use of e-voting,'' while the glass-half-full system-security expert concluded “as imperfect as the current system might be when judged against a nonexistent ideal, the current system generally appears to achieve its stated goals, under the corresponding assumptions and the specific threat model around which it was designed.''
Switzerland's E-voting: The Threat Model, by Appel https://freedom-to-tinker.com/2022/07/01/switzerlands-e-voting-the-threat-model
As the system-security expert pointed out, there is a danger in limiting a security assessment to a specific threat model. That expert pointed out that the printing company, that sends paper credentials to voters before each election, can corrupt the election if hacked or dishonest, but was excluded from the threat model that he was asked to consider. Here we identify a new threat model: it's a real security risk, if voters use smartphone cameras to speed the process of entering code numbers from the paper credential document.
Source: Andrew Appel via The Risks Digest