CPI Talk - Somebody else’s problem: Verifiability and accountability in Canadian online elections.

Most online voting systems used in Canadian municipal elections provide no public evidence that votes were recorded and counted. Voters, candidates, and courts are asked to accept the result on trust. Over several election cycles, working only from publicly observable information, our group has found a range of vulnerabilities in these systems. Without verifiability, attacks could go undetected.

These findings have also proven difficult to act on. Vendors and municipalities generally publish no vulnerability disclosure policy, and our 2025 findings on credential harvesting led to no changes, seemingly because no party had the mandate or the means to address them.

The underlying problem is one of governance. In our experience, municipalities point to a lack of voter demand for verifiability, and vendors point to a lack of demand from municipalities. Voters are rarely part of the conversation. The province has largely left the matter to municipalities, and federal bodies have generally treated municipal elections as outside their mandate.

In this talk, we will share early observations from the 2026 municipal election and examine why assigning responsibility for the integrity of online elections has proven so difficult.