From UNITA elections to E-Vote-ID 2025: peer-reviewed paper on E2E verifiability and low coercion

Eligo is pleased to share a milestone for our research and product roadmap. A peer-reviewed paper documenting our joint work on the UNITA Student Assembly elections—“Experience from UNITA Elections: Reconciling Revote, E2E Verifiability and Low Coercion”—has been accepted for presentation at E-Vote-ID 2025, the 10th International Joint Conference on Electronic Voting, held 1–3 October 2025 in Nancy, France. The paper will be presented in Track 3: Election technology in practice on Thursday, 2 October 2025.

As part of this work, Eligo partnered with SEEV Technologies, a UK spin-out led by Prof. Feng Hao of the University of Warwick, co-author of the DRE-ip protocol. Our collaboration enabled an online voting system that supports revoting, E2E verifiability, and low coercion—and does so with a usability profile suitable for real-world, large-scale student elections.

Below we summarise the context, core ideas, and why this matters for organisations seeking trustworthy, usable digital elections.

The context: UNITA’s first Student Assembly elections, at scale

UNITA is a European alliance of universities with nearly 250,000 students and 21,000 staff. In March 2025, UNITA held its first Student Assembly elections entirely online. Eligo provided the multilingual voting platform; SEEV Technologies provided the E2E verifiability layer. Warwick’s press office reported the deployment as the first real-world use of the Self-Enforcing E-Voting (SEEV) approach, integrated with Eligo and independntly operated to preserve anonymity through a separation of control.

From an operational standpoint, three constraints made this election a demanding testbed:

• Revote requirement — voters could cast multiple ballots up to closing time, with only the last one counted.
• E2E verifiability — voters and observers needed cryptographic evidence that ballots were cast as intended, recorded as cast, and tallied as recorded.
• Low coercion — the system had to minimise the power of outside pressure or vote-selling to influence choices.

Those requirements often pull in different directions. Our goal was to reconcile them in a single, deployable system, with a user experience suitable for ordinary voters.

The research contribution: revote + E2E verifiability + low coercion, in practice

The accepted paper details a deployed system based on a variant of DRE-ip—a line of protocols designed for E2E verifiability without relying on tallying authorities. To support operational constraints and privacy, the system used a two-server architecture with separation of control, reducing linkability between a voter’s identity and their encrypted ballot.

Why this matters:

• Revote at scale. Revoting helps genuine voters correct mistakes and weakens coercion: a coerced voter may later cast a private, final vote. Yet revote complicates cryptographic accounting and receipt semantics. Our deployment shows how to incorporate revote while preserving the E2E guarantees expected in modern Internet voting research.
• End-to-end auditability for real elections. E2E verifiability has matured over two decades of research, but production deployments have often faltered on complexity or usability. The UNITA rollout contributes a documented, peer-reviewed case study of a verifiable online election with thousands of eligible voters and heterogeneous institutions.
• Low-coercion mechanisms. By combining revote, careful credential handling, and usability constraints aligned with academic communities, the system reduces opportunities for pressure without imposing undue burdens on voters. The paper situates these choices among current approaches to coercion-mitigation.

For readers new to the field: DRE-ip (Direct Recording Electronic with Integrity and enforced privacy) is part of a family of verifiable schemes that aim to provide E2E guarantees, with DRE-ip distinguished by not requiring a set of tallying authorities. This lineage builds on widely accepted definitions of E2E verifiability in the literature.

Why this result is significant for universities and associations

Many institutions value transparency, broad participation, and operational simplicity—but often assume they must trade one for another. The UNITA deployment offers a different message:

• Low coercion is achievable without exotic hardware. The system design reduces the utility of coercion and vote buying without demanding specialised equipment from voters. This is especially relevant for distributed organisations—consortia, federations, and university alliances—where participants span countries, languages, and IT environments.
• E2E Verifiability can be practical. With the right integration boundaries, a verifiable backend can interoperate with a user-friendly front end. Warwick reports that the Eligo/SEEV integration preserved anonymity through organisational separation and provided receipts that allow voters to independently check the tally, while maintaining an experience appropriate to student elections.
• Revote strengthens autonomy. Allowing voters to update their ballot before closing time mitigates common risks: accidental selections, device or network issues, and pressured voting. When combined with E2E mechanisms, revote helps align legal/regulatory requirements with practical voter empowerment. (Our paper details how to do this without breaking the audit trail.)

How the architecture supports the goals

At a high level—full details are in the paper—the system includes:

• Two-server separation of control. Identity management and ballot handling are separated between independently managed servers. This reduces the risk that any single party can link identities to ballots.
• Receipts for E2E verifiability checks. After casting, voters receive cryptographic material enabling them to verify that their vote was recorded and included as intended, and to check the integrity of the final tally. (SEEV’s approach achieves this without relying on a set of tallying authorities.)
• Revote semantics. The system enforces a “last vote counts” rule up to closing time, ensuring that any earlier, potentially coerced submission can be superseded by a private final vote—while preserving E2E verifiability of the overall result.

The outcome is not a theoretical blueprint; it is a reported deployment in a real election context, with the academic community now reviewing and discussing the design choices and evidence.

What this means for Eligo customers

For Eligo, this project continues a multi-year path: bringing research-grade verifiability into a production-grade voting platform used by universities, associations, unions, cooperatives, and corporate bodies.

• If you are a university or consortium: Verifiable online voting can be deployed across member institutions with diverse IT policies and languages, while giving each voter tangible means to check the process.
• If you run assemblies or elections with sensitive choices: Low-coercion design paired with revote semantics can improve confidence without increasing administrative burden.
• If you require auditability: E2E mechanisms provide independent, voter-driven checks—complementary to traditional oversight and organisational procedures.

Eligo is incorporating additional verifiability capabilities into upcoming releases, continuing to prioritise usability for organisers and voters alike.

Read the paper and learn more

• Paper (Cryptology ePrint Archive): Experience from UNITA Elections: Reconciling Revote, E2E Verifiability and Low Coercion — available on the IACR ePrint Archive.
• Conference: E-Vote-ID 2025 (1–3 October 2025, Nancy, France) — main site and programme.
• Programme Committee (E-Vote-ID 2025): list of general chairs, local chairs, and PC members.
• Background on DRE-ip & SEEV: introductions to the protocol line and Warwick’s SEEV deployment with Eligo for the UNITA elections.

Acknowledgements

We thank Prof. Feng Hao and the SEEV Technologies team for the collaboration, the UNITA alliance for the opportunity to support democratic participation across member universities, and the Eligo engineering team for integrating, testing, and operating the system under tight deadlines. We also thank the E-Vote-ID community for its rigorous review and for providing a forum where research and practice meet.

About E-Vote-ID

E-Vote-ID is the leading international event focused on electronic voting, drawing researchers, election administrators, solution providers, and policymakers for three days of single-track discussion in early October each year. Since its inception, it has showcased hundreds of contributions and remains a reference point for both theoretical advances and practical case studies. For 2025, the conference is hosted in Nancy with general chairs from KIT, Kozminski University, and University of Luxembourg, and local chairs from CNRS and Inria.

If your organisation is considering verifiable online elections, with real-world usability and low-coercion design, our team would be happy to discuss how these capabilities can fit your governance model and compliance needs. Contact us.

FAQ