Prototype E-Voting System Solves Coercion Issue

Over the past decade, many studies have identified coercion and corruption as major challenges for electoral integrity around the world. In 2024, the Global State of Democracy Report found that the credibility of elections is under threat with concerns about whether voting is free, fair and transparent and results are increasingly contested.

Globally, in-person marked ballot papers - where a voter shows an ID, enters a private booth, marks their ballot and puts it in a secure box - are the most common form of voting. While this system isn't perfect, it is the current state-of-the-art standard in coercion resistance.

Remote, online e-voting is an attractive alternative to in-person voting, due to its convenience and potential to increase voter turnout, yet the promise of electronic voting has often run headfirst into serious concerns including security vulnerabilities, voter privacy, scalability, and, perhaps most challenging, coercion resistance.

Coercion occurs when anyone attempts to threaten or intimidate a voter into voting a particular way (or into not voting at all) or offers money or other rewards for voting in a particular way. A coercer could be a spouse or other family member, neighbor, employer, party activist, or even a foreign government attempting to influence an election's outcome remotely by offering money or cryptocurrency to buy votes over the Internet.

A practical, fully coercion-resistant e-voting pipeline

Now, EPFL researchers from the Decentralized and Distributed Systems Laboratory (DEDIS) in the School of Computer and Communication Sciences have developed a new, end-to-end e-voting system prototype - from voter registration through to ballot casting and vote tallying once an election is closed. Named Votegral, it demonstrates that a fully coercion-resistant e-voting pipeline isn't just theoretically possible, it can also be practical.

"Votegral is a coercion-resistant voting system that ensures that no voter can be forced or bribed into casting a ballot in a particular way - because there's no way to prove how they vote. This protects against vote buying, domestic coercion - like a controlling spouse - and manipulation by employers or political groups," explained Professor Bryan Ford, head of DEDIS.

In a paper presented at SOSP 2025, the 31^st Symposium on Operating Systems Principles in South Korea, the DEDIS researchers outline how most existing systems - including traditional mail-in ballots - fail this test, while Votegral tackles the coercion problem head-on using a technique known as fake credentials.

Using advanced cryptographic technology called interactive zero knowledge proofs, coerced voters can generate fake credentials and use them to submit fake ballots - ballots which the system can later filter out during tallying, leaving only the legitimate votes. Until now, however, this approach was far too slow to be practical.

From Prototype to Possibility

Bottlenecks in vote counting happen immediately after a vote closes because all the ballots need to be processed very quickly in a random order that makes sure that no ballot paper can be connected to the identity of any voter.

Prior coercion-resistant systems using a similar design took more than 1700 years to count one million ballots. The Votegral prototype was able to reduce that time to just 14 hours, using the researchers' novel optimizations in cryptographic proof generation and performance tuning.

"This is competitive with Swiss Post's e-voting system, which currently takes about 25 hours to tally one million votes using zero-knowledge proofs. Votegral's system also fits within legal time limits for announcing results in many. In addition, when voters or their coercers cast ballots with fake credentials they need to be filtered out of the final tally, and this is time consuming. We've now also optimized this step," said Louis-Henri Merino, a doctoral assistant with DEDIS and first author of the research paper.

Plug-and-Play?

Votegral's architecture was designed to be compatible with Swiss Post and other e-voting systems globally. With further development, the system could potentially "plug into" existing e-voting infrastructure and add coercion resistance without overhauling an entire system.

The researchers hope to find a partner or multiple partners with an international mindset to turn the prototype into a production-ready, fully deployable system with the costs and benefits shared globally.

Looking ahead

Until now, governments have largely been resistant to adopting e-voting due to two key challenges: the lack of coercion resistance in e-voting systems and an inability to verify code correctness. Votegral now provides solutions to the first problem.

A future issue that governments are already considering is the ability of quantum computing to break today's cryptographic algorithms and de-anonymize or reveal how everyone voted in past elections. But the researchers are confident that answers already exist.

"We already know that we can solve this problem without using state-of-the-art post-quantum cryptography algorithms. Of course, there needs to be a post-quantum version of Votegral and whilst this remains a future step, we know it's doable, there's no question about that," said Ford.

What the researchers really hope is that their work changes the conversation around e-voting, proving that coercion resistance is not a pipe dream - it's a technical problem with a technical solution.

"The research part of the problem is now solved. We're excited because Votegral closes the last known plausibility question. We know that this problem is solvable end to end and top to bottom, and with political will, sufficient time and investment. The only question now is whether somebody is going to step up and do that," he concluded.