Cybersecurity and Postal Voting: Digital Services and Physical Ballots

Ensuring Election Integrity: Strategies for Cybersecurity in Voting Processes

Election-related digital services need security, but postal voting must not be confused with casting a ballot online. This article discusses general safeguards and clearly separates hypothetical risks from evidence of an actual incident.

Online application is different from the ballot

In the Spanish Correos procedure linked below, an eligible voter can submit the postal-vote application online using the accepted electronic identification. The application is processed and voting documentation is provided; the vote is then submitted physically through the postal procedure. An online application does not mean the ballot itself is transmitted as an internet vote.

Eligibility, identification, dates and submission arrangements depend on the election and applicable instructions. Check the current official information rather than relying on an old article or a social-media message.

General digital risks

Impersonation websites, phishing and compromised accounts can put personal information or access to a digital service at risk. These are reasons to assess authentication, access controls and communications. They are not evidence that ballots have been altered or that an election result has been manipulated.

The physical chain of custody is a separate operational and legal subject. A hypothetical scenario about transport cannot be presented as a verified failure by Correos without evidence.

Practical checks

  • Enter the official service directly and verify its domain before providing personal information.
  • Use the identification and submission methods published for the relevant election.
  • Keep official acknowledgements and follow the current instructions for any enquiry.
  • Report suspicious messages through the official service or the relevant security channel, without circulating unnecessary personal information.

Organisations operating supporting systems should assess availability, authorised access, logging, supplier dependencies and incident response. Security claims about a particular process need evidence and a defined scope.

Official reference: Correos — postal-vote information. Editorial review: 30 October 2026.