Tory leadership: How secure is the online vote?

The Conservative Party has given details of how its new leader - and the next prime minister - will be elected.

Conservative MPs will vote for their preferred candidate to succeed Liz Truss in a series of ballots. But if there are still two candidates remaining after these votes, then the contest will be decided by Conservative Party members "via secure online voting".

Voters will have to have been members for at least three months to be allowed to participate.

The ballot will close at 11:00 on Friday 28 October.

Conservative Party chairman Jake Berry was asked this and replied: "Without going into the security measures we will take, for reasons I'm sure you will understand, we are satisfied that the online voting system will be secure".

During the last Tory leadership election, held over the summer, the opening of the online ballot was delayed after the National Cyber Security Centre (NCSC) - which is part of GCHQ - reportedly warned that the system could be vulnerable to outside interference.

When the ballot did open, the rules were changed so that members could no longer change their minds once they had submitted their votes.

Members were sent a ballot pack by post that contained two security codes that allowed them to vote online. They were also sent a paper ballot that they could return instead if they preferred, but that will not be an option this time.

The NCSC has told us it will be involved with the latest election as well: "As the UK's national technical authority for cyber security we continue to provide advice to the Conservative Party, including on security considerations for online leadership voting."

But there are still concerns about the safety of using online voting.

The Electoral Commission is not involved in the Tory leadership vote. It told us it was its job: "to oversee the delivery of well-run elections, including general elections or local elections, but not internal party contests".

Online voting is not allowed in general elections or local elections.

"This is the Conservative Party, not a national election campaign, so they don't have the full resources of the state," said Emily Taylor Chief Executive of Oxford Information Labs, a company specialising in cyber security.

"That means it's highly unlikely that they will have the resources needed to handle the cyber security satisfactorily."

Professor Steve Schneider, director of the Centre for Cyber Security at the University of Surrey was the editor of a report on internet voting in the UK that concluded the technology was not yet good enough to allow important elections to be held online.

"We don't allow online ballots for industrial action because of security concerns," he told BBC News. It seems to me that electing the next prime minister is even higher stakes."

In 2017, Sir Ken Knight carried out a review for the government of online voting for strike ballots, which concluded that they should not be introduced straight away but should be trialled to see if they could be made resilient to cyber attacks and hacking.

The government has not yet responded, but it was reported earlier in the year that it was preparing to formally reject the proposals citing concerns about security.

There have been questions asked about who is allowed to vote in the leadership election.

BBC News pointed out that the approximately 1,600 members of Conservatives Abroad, who do not need to be British nationals or be allowed to vote in UK elections to join, are nonetheless allowed to vote in leadership elections.

During the last leadership election, one news organisation registered foreign nationals, a person who did not exist and a pet tortoise as members of the Conservative Party.

There are also concerns that, with less than four days allowed for members to vote, "there's little time to sort out problems that always come up", Prof Schneider says, giving the example of members having moved or changed their email addresses.

There is also a problem that not all Conservative Party members will be able to vote online and there is not much time to help them.

Jake Berry said: "All efforts will be made including outreach to members for whom we don't have an email address or members who are unable to vote online."

We asked the Conservative Party for further response to the security concerns but they have not yet got back to us.

Additional reporting by Daniele Palumbo