How Do We Ensure the Security, Integrity, and Confidentiality of Voting

Ensuring the Confidentiality (Anonymity) of Votes

The anonymity of votes is ensured in the following ways:

Voting with a Voting Code

Each voter votes with their own voting code, which is uniquely generated and randomly assigned for each vote, making it impossible to identify the voter from the code.

Physical Separation of the Code Distribution System and the Vote Collection System

Level 1:

The system for distributing codes is physically separated and independently maintained from the system for collecting and processing ballots. The eglasovanje.si platform ensures that data about which code was sent to which address is not stored. Additionally, it is impossible for anyone attempting to influence the voting process to obtain this information without fully taking control of the entire organization and management of the eglasovanje.si platform.

Level 2, Level 3:

When distributing ballots, the ballot distribution commission is physically separated both in terms of personnel and information systems from all other eGlasovanje systems. Therefore, there is no need to trust the information system not to secretly record the connection between submitted ballots and distributed codes, and system administrators have no means to store information that could identify the owner of the ballot. Since the codes are sent through a completely separate system from the voting system and via systems that do not store email addresses and are not owned by the organization or within the reach of individuals who might want to manipulate the voting, the connection between the code and the email address is effectively nonexistent.

Proxy Server (Level 3 Only)

When submitting votes, a separate electoral commission (the voting process involves two commissions—one for distribution and one for vote collection) ensures that no additional data ("metadata"—IP address, browser fingerprint, etc.) is collected that could potentially reveal the identity of the voter (although this is relatively difficult in any case). The electoral commission forwards the ballots to the eglasovanje.si system through a proxy server. Thus, the eglasovanje.si platform never directly interacts with the person submitting the ballot and therefore cannot reveal their identity.

Level 2 and Level 3 provide an extremely high level of anonymity that meets or even exceeds postal voting. No advanced, difficult-to-understand technical solutions are required to use these levels.

Level 1 provides effective anonymity, assuming trust in the eglasovanje.si system administrators not to misuse their own system. For very frequent votes with a low level of "sensitivity" (e.g., votes of smaller organization boards, congresses of small associations), this level provides sufficient security, especially considering that most organizations currently use much less secure systems for remote voting (or do not use secret voting at all).

Ensuring the Accuracy of Results

The accuracy of the results is ensured by publishing a list of all submitted ballots. Each voter can verify with their (secret) code that:

Their vote was correctly recorded
The number of submitted ballots is correct
The result calculation is accurate
The document they received is the same as the document received by other voters

The list of results is distributed as an email attachment, not as a centrally hosted document. Consequently, each voter has their own copy of the result list, preventing an attacker from altering the list in such a way that each voter sees their ballot correctly, but others incorrectly, thereby presenting a desired incorrect (and published) result.

If just a few random voters—those that the attacker cannot predict—compare the received documents among themselves, they can quickly determine whether everyone received the same version, preventing a potential attacker from sending each person their own version with the intention of falsifying the results.

In this way, we can effectively prevent any vote manipulation that would not be easily detectable by an independent review by the voters.