← All posts

A mathematical 'proof' the votes were counted right — with a secret backdoor built in

Switzerland published its e-voting source code so anyone could check it — and within weeks, cryptographers found a backdoor that let an insider produce a mathematically valid proof while silently changing the votes.

It is the spring of 2019, and somewhere in the offices of Swiss Post, a decision is being made that looks like radical transparency. The federal postal authority, working with its Spanish vendor Scytl, is about to publish the full source code of Switzerland's internet-voting system. Not a summary. Not a brochure. The actual code — every line — open for the world to read, attack, and judge.

This was supposed to be the moment that settled the argument.

Switzerland had been fighting about internet voting for years. Critics said you couldn't trust a black box. Officials said the system was verified, audited, certified. So Swiss Post did something almost no election authority in the world had dared to do: it opened the box. Come and look, it said. We have nothing to hide.

Three independent researchers — Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague — took Swiss Post at its word. They looked.

What they found should have been impossible.

A proof that proved nothing

To understand what Lewis, Pereira, and Teague discovered, you need to understand what the system was claiming to do.

Internet voting has a fundamental problem: when a voter submits a ballot over the internet, how does anyone — including the voter — confirm it was counted correctly, and not swapped for a different ballot by a server in the middle? The answer cryptographers developed is called a mixnet, or mix network. Votes come in encrypted. The system shuffles them — like cutting a deck — and then, crucially, publishes a mathematical proof that the shuffle was honest: that it moved the votes around but changed none of them.

This proof is the system's core claim to verifiability. Anyone with the right software can check it. If the proof passes, the votes are intact. If the proof fails, you know something is wrong.

Except there was a trapdoor built into the proof itself.

Lewis, Pereira, and Teague documented their finding in a paper they titled — with a nod to Magritte — Ceci n'est pas une preuve. "This is not a proof." They found that the shuffle proof in the Swiss Post–Scytl system used a trapdoor commitment scheme: a mathematical structure that functions honestly under normal conditions, but which, if you know a hidden set of values (the trapdoor), you can exploit. An authority holding those values could generate a shuffle-proof transcript that would pass every verification check — while having actually altered votes.

Read that again slowly. The proof could pass. The math would check out. Every auditor's software would say: verified. And the votes would be wrong.

This was not a theoretical quibble. It was a functional backdoor, embedded inside the very mechanism the system offered as its guarantee of integrity. The thing you were supposed to check to confirm the count was the thing that could be faked.

What "verifiable" actually requires

Swiss Post and Scytl acknowledged the finding. Swiss authorities suspended the e-voting system pending remediation. No binding election had been run on the flawed system, so no votes were actually altered. But the episode cuts to the bone of a question every election-technology claim has to answer:

Verifiable for whom?

A system can hand you a mathematical proof and still be lying to you — if the structure of the proof itself contains a secret lever only the system operator knows how to pull. The Swiss Post system didn't just claim to be secure. It claimed to offer universal verifiability: a guarantee that anyone, armed with published data, could confirm the vote was counted correctly without trusting any single authority. That claim was false. The verification was real only if the authority played fair. Which is precisely what verifiability is supposed to protect against.

The German Federal Constitutional Court grasped this logic a decade earlier, in its 2009 ruling that banned voting computers the public couldn't independently check. The court held that the essential steps of voting and of the determination of the result must be examinable by the citizen reliably and without any specialist knowledge. It wasn't asking for perfection. It was asking for something a non-expert could follow. A cryptographic proof that only a trained researcher can analyze is already a step removed from that standard — and a proof that a backdoored scheme produces is worse than no proof at all, because it actively misleads.

The Swiss Post case shows the deeper problem. A black-box system that says "trust us" is obviously asking for faith. But a published-code system that says "check the math" and embeds a trapdoor in the math is asking for the same faith while disguising it as evidence. The appearance of verifiability is more dangerous than the admission of opacity, because it forecloses the question.

How open code caught the flaw that certification missed

Here is the thing worth holding onto: the flaw was found because the code was published.

Swiss Post did not have to open its source. Most vendors don't. The certification apparatus that exists in most democracies — in the United States, the Election Assistance Commission's voluntary voting-system guidelines; in other jurisdictions, national testing laboratories — involves experts examining systems under controlled conditions, often under non-disclosure agreements, with their findings summarized but not always published. When an examiner says "we tested it and it passed," the public is trusting the examiner. The reasoning is hidden.

When Swiss Post published the code, it made a different kind of examination possible: adversarial, independent, unrestricted. Lewis, Pereira, and Teague were not paid by Swiss Post. They had no confidentiality agreement. They published their entire analysis, with citations and equations, for anyone to read and dispute. That is not a certification process. That is a scientific one — and it found what the certification process had not.

The gap between those two processes is worth naming precisely. Certification tests whether a system behaves correctly under expected conditions. Independent cryptographic review tests whether the system's claimed guarantees hold under adversarial conditions — including the adversary being the system operator. That second question is the one that matters most, and it is the one that only open publication allows.

Compare the DC internet-voting trial of 2010, where a University of Michigan team gained near-complete control of a public ballot-return pilot within roughly 48 hours — precisely because the jurisdiction opened the system to public testing before real votes were cast. The vulnerabilities were caught because someone was allowed to attack. Or consider the New South Wales iVote system in 2015, where researchers found serious flaws in a live election that had already collected around 280,000 votes — flaws that a pre-election security review had cleared. In each case, the finding came from outside the official process, not from it.

The pattern holds: open inspection finds what closed certification misses. Not always. Not automatically. But consistently enough that the burden of proof has to shift. When an authority says "we certified it," the question to ask is: certified by whom, against what threat model, with what access, and with the findings published where?

The trapdoor as a category problem

The specific flaw in the Swiss Post system — a trapdoor in a cryptographic proof — is not an implementation bug in the ordinary sense. It is not a buffer overflow or a misconfigured server. Those are errors. This was a design choice, or at minimum a design failure, in the mathematical structure that the system's verifiability guarantee rested on.

That distinction matters because it tells you something about the limits of testing. You can probe a software system for arbitrary bugs indefinitely and still miss a trapdoor commitment scheme, because the scheme functions correctly from the outside — it produces the right-shaped outputs, it passes the right-shaped checks. The flaw is invisible unless you examine the mathematical specification and notice that the commitment scheme used has a property the designers either didn't know about or didn't disclose.

This is why the argument for cryptographic verifiability in elections cannot stop at "we published the code." It has to extend to: the mathematical proof structure must itself be independently auditable by people who are not the vendor or the authority, and who are motivated to find problems rather than to certify them.

Lewis, Pereira, and Teague were motivated to find problems. They found one. That is not an indictment of Swiss Post's intentions — the company acknowledged the finding and moved to fix it. It is an argument for the process that produced the discovery.

What "the audit confirmed it" leaves open

When the Swiss Post system was suspended, officials could say: the process worked. A flaw was found; deployment was halted; remediation would follow. And in a narrow sense, that is true. But it is worth asking what would have happened if the code had not been published.

The answer is: the same proof would have run, the same transcripts would have been produced, and anyone checking them would have seen: verified. The certification would have passed. The officials would have said: the system was audited. The public would have had no way to know that the proof proved nothing.

A verifiability claim you cannot independently check is indistinguishable from no verifiability at all. This is not a criticism unique to e-voting. It applies to every assertion of correctness in an election system — paper counts included. Georgia's 2020 hand count of roughly five million ballots confirmed the machine-tabulated outcome to within about a tenth of a percent, which is impressive. But it depended on the existence of durable paper ballots that could be independently examined, not on trusting the machines that counted them the first time. The paper was the independent check. The proof you could actually inspect.

The Swiss Post case is the cryptographic equivalent: the code, once published, was the paper. And the paper showed the proof was a fiction.

What would make it genuinely checkable

The Swiss Post episode does not end the case for cryptographically verifiable elections. It defines what that case actually requires.

A shuffle proof is the right kind of mechanism — a mathematical guarantee that no votes were altered in transit, checkable by anyone with the software to verify it. But for that guarantee to be real rather than performed, several conditions have to hold simultaneously:

First, the cryptographic scheme must not contain trapdoor values. This is a mathematical requirement: the commitment scheme used in a shuffle proof must be binding and hiding without a secret backdoor. There are well-understood schemes that satisfy this without trapdoors; the choice of which to use is not a vendor detail but a public design question.

Second, the proof must be independently verifiable by parties who have no stake in the outcome. Not just one certification lab. Multiple independent cryptographers, with the full specification and implementation, publishing their findings for public critique.

Third, the end-to-end chain from voter to final tally must be auditable without trusting any single point in the chain. A voter who casts an internet ballot should be able to confirm their encrypted ballot was included in the mix; any observer should be able to confirm the mix was honest; and the final decryption should be independently reproducible. None of these steps should depend on the authority's cooperation or good faith.

Fourth — and this is the hardest — the verification process itself must be accessible enough that the German Constitutional Court's standard is met: ordinary citizens, not just expert cryptographers, must be able to confirm the essential steps. That may require software tools, interfaces, and documentation that go far beyond what any current system provides.

None of these conditions were fully met by the Swiss Post system in 2019. Some of them are not met by any currently deployed election system in the world. That is the honest position. The Swiss Post case is not a story about a flaw that was found and fixed and so everything is now fine. It is a story about what happens when you publish enough for outsiders to find the problem — and what it would take to publish enough that the finding could happen before deployment, systematically, rather than as a fortunate accident of independent research.

The villain is the proof you can't check

The specific trapdoor in one Swiss vendor's shuffle proof is not the point. The point is the category of claim: mathematically proven correct, offered in a form that forecloses outside inspection. Every election system makes claims. Vendors claim certification. Officials claim audit. Cryptographers claim verifiability. Every one of those claims is only as strong as the mechanism that lets an independent outsider confirm or refute it.

When that mechanism is a black box, the claim rests on trust in whoever built the box. When it is published code, the claim can at least be scrutinized — and sometimes refuted. When it is a published cryptographic proof using a scheme with a trapdoor, it is a performance of verifiability: the appearance of the thing without the substance.

The villain in the Swiss Post story is not Swiss Post, and it is not Scytl. It is opacity disguised as transparency — a proof that looks checkable and isn't. The fix is not to give up on cryptographic verifiability but to demand the real version of it: schemes without trapdoors, review without confidentiality agreements, proofs that independent researchers can check and, when necessary, disprove.

That is what TrustVoting is building toward: a system whose correctness no one has to take on faith, because the evidence is published in a form anyone can inspect. Not "we had it audited." Not "the math checked out." Here is the math. Check it yourself.

The shareable version: Switzerland published its e-voting code to prove it was trustworthy. Researchers found a trapdoor that let an insider fake a valid proof while changing votes. The proof passed. The votes would have been wrong. "Verified" only means something if someone independent is allowed to do the verifying — and allowed to say no.

What is still not checkable: whether any other currently deployed cryptographic e-voting system uses a similarly problematic commitment scheme, and whether the certification processes those systems passed included adversarial independent cryptographic review with published findings. Until that review exists and its results are public, "the system was certified" remains a claim, not a proof.

What would make it checkable: full publication of cryptographic specifications and source code, independent multi-party review with no NDAs, and published findings — including negative ones — before any binding election is run.

See how common this verification gap is across the world →

Read the 2-minute version of this problem →

Explore documented cases of unverifiable election results →

Sources

See all postsExplore the gaps