Election resilience starts before the incident: what I proposed to the CEC and what Latvia's 2026 election showed

The proposal treated election resilience as more than the availability of one information system. It covered the linked process of voter eligibility checks, voting, records and evidence, storage, counting, aggregation, publication and the ability to reconstruct what happened after an exception or incident. Its purpose was to reduce the risk that a technical or organisational disruption, cyber incident, physical threat or information operation could unjustifiably restrict voting, break the evidence chain or make the event difficult to reconstruct.1

For every critical P0 measure I proposed recording status, accountable function, deadline and readiness evidence. The practical measures included combined-disruption exercises, testing of the electronic voter-register fallback procedure, a change freeze with controlled emergency change and rollback, traceability of software releases, DDoS and communications escalation tests, backup restoration, failover, privileged-account review and a common incident-evidence package.1

The key idea, however, was not the list of controls. It was an operating model: normal mode → degraded mode → offline/manual mode → recovery and reconciliation. Each transition should have a clear trigger, decision authority, authoritative data source and evidence showing that the transition can be performed safely.

The stored-ballot process is useful because it cannot be reduced to one technical defect. On 2 October the CEC reported that 174,517 voters, or 11.20% of eligible voters, had used advance ballot storage.4 At that scale resilience depends not only on platform stability but on a predictable procedure for checking whether a voter has voted again and which ballot remains countable.

When that verification became a bottleneck on election night, the CEC changed the operational sequence.3 An emergency decision is not itself evidence of system failure. A resilient system needs a lawful and controlled way to make such decisions when the planned sequence no longer fits reality. The assurance questions are whether the transition had been modelled, whether thresholds and responsibility were clear, whether the decision is reconstructable and whether data and paper records can be reconciled afterwards.

The 1 October correction of published figures raises a similar point. Correcting data is not inherently a problem; a mature system must be able to correct errors. The trust question is traceability: what the previous state was, what discrepancy was found, which source justified the correction, who approved it and whether a presentation error can be distinguished from a change to the underlying record.2

On 22 September the ministry, together with the CEC, VDAA and CERT.LV, publicly stated that the election platform was ready and that stability, cybersecurity and operational-readiness measures had been carried out.5 That is an important public assurance. From a systems-assurance perspective, however, the word “ready” is only as strong as the evidence behind it.

My proposal therefore asked for a non-sensitive link between material tests and the actual production version and configuration, along with scope and exclusions, predefined acceptance criteria, remediation and retest status for significant findings, and the existence of a residual-risk decision.1 None of this requires publishing exploitable details. It requires being able to demonstrate that the test actually applies to the system being relied upon.

The same distinction matters for continuity controls. A documented fallback is not the same as a rehearsed fallback. A successful backup job is not the same as a tested restore. Redundant infrastructure is not the same as a successful failover. Election assurance should keep the boundary between “documented” and “demonstrated” explicit.

There is another part of this story that is not about voter registers or counting. It is about how the state uses professional civic participation. I submitted the proposal as an independent technology and cybersecurity professional, not as a party representative. The document deliberately avoided claiming that a control did not exist merely because it was not public, and it explicitly separated responsible proposals from unauthorised active testing.1

At the end of the submission I asked the CEC for a substantive reply through my official electronic address.1 As of 6 October, while preparing this article, I have received neither a substantive response nor an interim response on the status of the assessment. I cannot know whether the document has been reviewed internally, forwarded to responsible teams or used in readiness work. That is precisely the problem: from the submitter's side, the participation chain stops at receipt.

The institution does not have to agree with me. It may conclude that a control already exists, that a proposal belongs to another authority, that a different mechanism is better or that my analysis is wrong. Any of those outcomes would be normal. Participation becomes formal rather than functional when the only visible outcome is that the document could be sent.

An external security signal should never be treated as automatically correct. A researcher may misunderstand the architecture, lack non-public context or miss compensating controls. That is why signals need validation. But the same logic works in the other direction: if a qualified signal does not pass through a visible assessment loop, the organisation cannot demonstrate that it distinguished a false alarm from an early warning.

In an earlier analysis of national cyber resilience I described the chain as signal → validation → owner → decision → action → learning.6 Civic participation on security and resilience issues should work in much the same way. Feedback is not merely a courtesy; it is part of governance because it establishes whether the signal has been assessed and where responsibility for the decision sits.

I therefore use the word “ignored” cautiously. I cannot claim that the CEC did nothing internally. What I can state narrowly is that by the time this article was prepared I had not received even an interim response about the status of the submission. From outside the institution that produces the effect of being ignored, and for critical-system governance that uncertainty is not a good control.

The August proposal already included a post-election phase: preserve evidence, reconcile data, review incidents, significant disruptions and near misses, and publish non-sensitive findings and concrete improvement actions.1 There are now real cases against which that process can be tested without turning the review into party politics.

A useful public review could answer practical questions: whether the stored-ballot verification delay had been modelled; what criteria were used to change the order of counting; whether such a scenario had been exercised; how correction history is preserved; which fallback procedures worked as designed; and where improvisation was required. That is not a search for blame. It is normal learning after a critical system has operated under real load.

This is where the August proposal remains useful. Not as a document that should be declared “right” after the fact, but as a checklist that can be compared with the actual election and used to make the next cycle more robust.

My 24 August proposal was not a prediction of the specific election-night delay, and I do not want to rewrite history as if it had been. The point was different: a critical system should not need to know the exact next incident in advance in order to change operating mode safely, preserve evidence and return to normal operation.

Election resilience is therefore not equivalent to saying “the system worked”. It is the ability to detect deviation, establish facts, make accountable decisions, move to another operating mode in a controlled way, preserve the traceability of data and decisions, recover, and explain afterwards what happened.

The same is true of civic participation. If the state wants to benefit from external professional competence, it does not need to accept every proposal. It does need a feedback loop that shows that a qualified signal reached an assessment and a decision. Otherwise a formal participation channel exists, but it is not clear whether the signal entering it became part of governance. That is a gap worth closing before the next incident, not after it.