Join us for the next CPI Talks — a public outreach lecture series.
Event details
Date: Wednesday, November 18, 2026
Time: 2:30 to 4:00 p.m.
Location: Enterprise Theatre, East Campus 5 (Room EC5-1101/1111), 305 Phillip Street, University of Waterloo
Please register in advance.
Abstract
Most online voting systems used in Canadian municipal elections provide no public evidence that votes were recorded and counted. Voters, candidates, and courts are asked to accept the result on trust. Over several election cycles, working only from publicly observable information, our group has found a range of vulnerabilities in these systems. Without verifiability, attacks could go undetected.
These findings have also proven difficult to act on. Vendors and municipalities generally publish no vulnerability disclosure policy, and our 2025 findings on credential harvesting led to no changes, seemingly because no party had the mandate or the means to address them.
The underlying problem is one of governance. In our experience, municipalities point to a lack of voter demand for verifiability, and vendors point to a lack of demand from municipalities. Voters are rarely part of the conversation. The province has largely left the matter to municipalities, and federal bodies have generally treated municipal elections as outside their mandate.
In this talk, we will share early observations from the 2026 municipal election and examine why assigning responsibility for the integrity of online elections has proven so difficult.
About the speaker
Aleksander Essex is an associate professor of software engineering at Western University, Canada. His research focuses on cybersecurity and cryptography, with an emphasis on evidence-based election technology and the unique cyber risks of online voting. He initiated and helped draft Canada's first national voluntary standard for online voting, published in 2024. He has advised numerous election agencies in Canada and abroad on the technical and democratic implications of adopting election technology.