Security is not created behind closed doors – it needs to be tested, questioned and challenged. That’s why Swiss Post once again invited ethical hackers from around the world this year to put its e-voting system to the test. During the public intrusion test, IT specialists were able to search for potential vulnerabilities in the e-voting system from 6 to 24 July 2026. For Swiss Post, this public stress test makes an important contribution to further strengthening e-voting and fostering trust in digital votes and elections. A new feature this year allowed a selected group to gain deeper access to the system and test it under new conditions.
In the following interview, hacker “13th” explains what appealed to him about the intrusion test for e-voting, which vulnerabilities he found and what ethical hacking means to him for trust in digital democracy.
What appealed to you personally about scrutinizing Swiss Post’s e-voting system?
A complete specification, open source code and a live environment – in Swiss Post’s e-voting intrusion test, all of this is available at the same time. This combination is rare. It turns the specification into a kind of security reference: instead of guessing what behaviour is intended, you compare the defined properties of the protocol with its implementation in the source code and in the live environment. Looking for vulnerabilities here really motivated me.
How do you prepare as an ethical hacker for testing a system as sensitive as a digital ballot box?
I don’t work as an individual researcher at a computer. My work is based on a system of AI agents with more than 25 permanently specialized roles. It’s a new approach to security analysis where I allow specialized roles to work independently of one another. Through so-called blind phases, conclusions are first developed separately in order to avoid groupthink and anchoring effects. What matters isn’t the number of agents involved, but a strict evidence model that tests and reproducibly verifies every hypothesis on the basis of traceable evidence. For the analysis of Swiss Post’s e-voting system, more than 214,000 lines of code were systematically examined in this way and concrete hypotheses were prepared before the start of the public intrusion test. These hypotheses were then specifically confirmed or refuted in the live environment.
How does hacking an e-voting system differ from other security or bug bounty programmes?
The main difference is that security here is built on several components and is time-dependent. This means it’s not enough to generate an unusual server response. Three pieces of evidence have to be provided separately: the flaw exists in the source code; it’s reproducible in the live environment; and it also applies under the real conditions of a vote. That’s precisely why many hypotheses were deliberately discarded during the public intrusion test after additional analyses had disproved their impact.
Was there a specific moment during your tests when you thought: “Now this could get interesting”?
One particularly exciting moment occurred when a deliberately modified test request affected the normal process of a second, independent voting card. Although this had no impact on votes or election results, it showed that certain effects can extend beyond their original context. For me, this was an important signal to examine the underlying connections more closely.
Swiss Post deliberately invites hackers to search for vulnerabilities. Why can this make a system more secure?
External specialists approach a system differently from the people involved in developing it. Interestingly, in our work, findings also regularly appear not where the original hypothesis would suggest, but elsewhere. It’s important to note that the aim is not only to fix errors. Improvements that lead to clarification or greater precision in the specification are also helpful, because they simplify subsequent public review. I submitted such an improvement, which the e-voting team has now included in the system description. The fact that findings emerge in a public test does not mean that a system is insecure. What matters is whether an organization can accept findings and translate them into concrete improvements.
Did your participation in the intrusion test change your trust in e-voting – and if so, how?
In my view, the public intrusion test and especially the extended testing environment show that continuous external review is necessary for a complex system such as e-voting. In a complex system, blind spots can arise, for example at the interfaces between application, infrastructure and specification. In my view, public tests are therefore central to trust in digital democracy: what’s needed is not a promise of absolute security, but the willingness to accept real results from public tests and to consistently improve the system on that basis.
What do you personally take away from the test – professionally, but also with regard to digital democracy?
In the extended test setup of the intrusion test, I was able to submit fifteen reports, including one finding with medium severity and two best practices (“low severity”) that were confirmed. For me, the test was also an examination of my methodology, which is based on the use of different agents. The most important conclusion from a societal perspective is that genuine trust emerges when it’s based on robust testing – explanations alone are not enough. Public review makes risks controllable and strengthens the reliability of e-voting.