1. Geneva's approach to Internet voting (eVoting) certification
towards certification,
the way of trust building
Council of Europe
Workshop on certification of e-voting systems
Strasbourg November 2009
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

2. Internet voting in Geneva Homologation vs. Certification
Summary
Context
Internet voting in Geneva
Homologation vs. Certification
Goals of the certification and the Information Security Management System (ISMS)
Project and ISMS eVoting
Conclusion
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

3. 1a – Institutional context
Geneva, an sovereign entity of 450'000 inhabitants and 45 municipalities
Its own government
Its own parliament
Its own laws
Switzerland = 26 cantons/sovereign entities
Works like the EU
One central government and parliament
A federal legislation that must be implemented by the 26 cantons
676'000 citizens living abroad (418'000 in Europe)
Life is not always simple !!!
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

4. 1b – Elections and referendums
Switzerland, the world champion for ballots
from January 2001 to December 2009
29 federal ballots, as follows
National parliament elections: 2
Referendums and initiatives: 75
in Geneva, cantonal and communal levels
59 ballots, as follows
Elections: 23
Referendums and initiatives: 119
Or, in Geneva: 7 ballots totaling 24 questions each year…
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

5. 1c – Political will Favorable conditions
Convergence of reflections on the cantonal cyberadministration and the federal one
The eVoting pilot project supported by the Confederation until the Geneva voters enshrine it in their Constitution ( – 70% "yes")
There are full legal basis at every level, federal and cantonal
14 binding eEnabled ballots in Geneva from January 2003 to November 2009
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

6. 2a – eVoting in Geneva The process
Protecting the vote secrecy in a way similar to the other channels (postal voting and polling station voting)
Citizens' control:
Security tests and audits performed, results made public
Possibility to view the source code
The electoral commission controls the eVoting process
Gradual change of the legal provisions to accompany the projects evolutions
Open to the citizens abroad (one system runs ballots conducted according to several cantonal laws)
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

7. 2b – eVoting in Geneva A system
Fundamentally different from voting machines
Double nature: remote voting and electronic voting through Internet
Discontinued use: exploited for periods of 3 weeks each
Complement the other voting channels
Specific safety and security measures
Continually improved at the software and the architecture levels
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

8. 2c – 11 security requirements
The voter :
Must be protected against ID theft
Can only vote if he/she is registered
Has one and only one vote
The electronic ballot must not be
Intercepted, modified or hijacked
Known before the official ballot counting process
Linked to a voter
The IT system must
Resist to a DoS attack
Be able to prove that a given voter has voted
Not accept votes outside of the voting periods
Be controlled by the authorities
The number of cast ballots must be the same as the number of counted ballots, any difference must be explained and corrected
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

9. 2d – Taking the eVoting security into account
Security has been integrated in the project from the start, with
Federal and cantonal legal basis
Formalization of security requirements
Description of the voting process
Mastering of the voting process
Audits and reports conducted by the Confederation and other stakeholders
Intrusion tests and security audits as normal procedure and conducted in the framework of each ballot
All external staff must sign an NDA
Implementation of a Security and information management system for the IT application (ISMS)
Compliance with Council of Europe recommendation Rec(2004)11
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

10. 3 – Homologation vs. Certification
Official third party recognition that an organization, a service or a process comply with predefined characteristics, a recognized norm, a rule or a legal requirement.
Certification
Written confirmation, issued by an independent and authorized body, regarding a compliance verification process.
Staff certification
Hardware and software certification (ISO 15408, usually lengthy and costly!)
Certification regarding the implementation of management system (quality-ISO 9001, security-ISO 27001, etc.)
 The federal law on data protection and the related ordinance on certifications foresee the possibility of certification for these two last points according to the above-mentioned ISO norms.
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

11. 4b – The State of Geneva ISMS aims
Developing a standardized and reproducible approach of security governance, in order to create a reasonable level of trust as well as bringing transparency into the internet voting process
Creating a system to manage the information security according to ISO norm and the PDCA model
Tailored to the eVoting domain, its challenges and the State context
The audit's approach:
"Say what we do and do as we say"
Anticipating interrogations and critics; communicating
Capitalizing on the acquired know how
 yet, our political framework is limiting certifications
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

12. Maturity of the security management
5a – The main steps of the project
01/
Reflections on certification and on
the actions
to be
undertaken
to achieve it
Presentation
ISO 27001
certification
coaching contract
constitution of the
project team -
Preparatory
works
Project plan
Beginning
of the project
ISO 27001
schooling
Modeling & perimeter,
Methodology and tools;
Documentary
basis;
Copil-1 :
Project's
progress 
Approach's
validation
Classification
methods Risks'
evaluation
Copil-2 :
Security goals
and risks
management  presentation and validation
Copil "eVoting" : presentation and validation of the risks'
evaluation
and
management "who deals with
which risks and when?"
audit
as exercise –> controlling that we master
the eVoting
process
 successful
Copil-3 end
of the project 
Beginning
of the
eVoting
ISMS
Maturity of the security management
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

13. Development, maintenance Security requirements
5b – ISMS and PDCA model
Development, maintenance
and
improvement cycle
Plan starting the ISMS
DO implemen-
ting and running
the ISMS
Check checking and evaluating the ISMS
Act supporting and improving the ISMS
Stakeholders
Security requirements
Security management
Model for the ISO norm compulsory clauses 4 à 8
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

14. End of project  ISMS operational management
5c – Axis of actions of the ISMS project
Actions
Commentary
Réf. ISO 27001
Management and direct implication of the eVoting project management team
- Project management
- Methodology and risks validation
- Capacity building
Ch.5 – Management responsibility
Documentation
EDM
§ 4.3 – Documentation requirements : control of documents and records
Methodology
State's SGSI/ISMS method and classification model
§ c) – Risk assessment approach
Risk evaluation and treatment
- Definition of perimeter
- Security policy
- Identification, evaluation, treatment
- Applicability declaration (SOA)
§ Plan : Establish the ISMS
§ Do : Implement and operate the ISMS
Audit
Audit as exercise
Ch. 6 Internal ISMS audits
End of project  ISMS operational management
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

15. 5d - ISMS: Statement of applicability SOA
5 Security policy
6 Organization of information security
15 Compliance
14 Business continuity management
7 Asset management
13 Information security incident management
8 Human resources security
12 Information systems acquisition, development and maintenance
9 Physical and environmental security
11 Access control
10 Communications and operations management
Best practices implementation, according to ISO (state: September 2008)
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

16. Responsibility of the owner of the eVoting system
5e – Current actions
Action
Commentary
Réf. ISO 27001
Implementation of safety measures
- Ongoing
§ – Do
Management of incidents
- Continuous
Management of steps; capacity building
ISMS control measures
§ – Check : monitor and review ISMS
Evaluation of the measures impact; reexamination of the risk assessment
§ – Check
ISMS management and improvement
- To be planned
(continuous improvement, corrective and preventive actions)
§ – Act : maintain and improve ISMS
Ch. 8 ISMS improvement
Revue de direction
Ch. 7 Management revue of the ISMS
Communication
§ – Act
Responsibility of the owner of the eVoting system
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

17. 7.1 Management review general
5f - Maturity/Compliance of ISMS 4
Total compliance 3
Partial compliance 2
Limited compliance 1
No compliance
ISO compliance
8.2 Preventive action
4.2.2 DO
8.2 Corrective action
4.2.3 Check
8.1 ISMS improvement – continual imporvement
7.3 Review output
Documentation requirements
7.2 Review input
5.1 Management commitment
7.1 Management review general
5.2 Ressource management
6 Internal ISMS audits
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"

18. 6 –Conclusion The way towards certification means
A commitment for means but not for results!
An approach that stimulates:
The mastering of activities and the improvement of the maturity level of the security and risk management of the information system
The development of competencies and knowledge
A tool for communication and understanding
A path towards trust
… certification has however no impact on the opinion of skeptics ("there will always be a black box somewhere in the system, no matter how hard you try to make it transparent")
SMSI e-voting - Cellule sécurité - DCTI
18/09/2018
Projet "Certification e-voting"