France’s left-wing presidential primary extended its first round of online voting after the e-votez platform was hit by a surge of bot-driven connections on Oct. 9, disrupting access for some voters.
The primary is jointly organized by the Socialist Party (PS), Place Publique and GRS, with voting conducted entirely online. In a statement, the organizing committee, known as COP, said the platform came under attack from the moment voting opened at 8 a.m. Friday. According to the committee, bots flooded the system with connections, leaving some voters unable to cast ballots.
Deadline pushed back to Sunday
In a later statement issued Friday evening, the committee said all participating parties and the five candidates had agreed to extend the first round. The deadline was moved from Saturday, Oct. 10 at 8 p.m. French time to Sunday, Oct. 11 at 6 p.m.
Turnout lagged early in the day
Patrick Mennucci, chair of the organizing committee, told AFP that only 20,000 people had voted by 7 p.m. Friday. The primary had about 140,000 registered voters, meaning roughly 14% had cast ballots after 11 hours of voting.
Mennucci said the system had "returned to normal" at 6:45 p.m. The report’s summary also said turnout had climbed past 70,000 by 8 a.m. Saturday.
Organizers say recorded ballots were not altered
The committee said the platform was never fully interrupted and that the integrity of ballots already recorded had not been compromised. In its Friday evening statement, it said technical experts had confirmed that the fairness of the vote had not been changed and that ballots were properly registered.
Le Parisien, citing a member of the organizing committee, reported that the platform normally handles up to 10,000 simultaneous connections. During the attack, that figure rose to 20,000, slowing the voting process. Organizers told voters that this was "only a traffic management issue, not a cybersecurity vulnerability."
Numerama classifies the incident as a DDoS attack
French tech outlet Numerama described the event as a distributed denial-of-service attack. Such attacks overwhelm servers with requests from large numbers of machines and do not require an intrusion into the system itself.
Numerama said the bots in this case imitated voter logins, tying up server resources and making them difficult to distinguish from legitimate users. The outlet said DDoS attacks target service availability, which is why organizers could still say that recorded ballots had not been modified.
Paris prosecutors and ANSSI step in
Mennucci told franceinfo that organizers filed a complaint at midday Friday. AFP later cited the Paris prosecutor’s cybercrime unit as confirming that a formal investigation had been opened.
France’s national information systems security agency, ANSSI, has also become involved. Le Monde reported that Prime Minister Sébastien Lecornu asked the agency to assist organizers by determining the nature and origin of the attack and by directing them to certified service providers to help restore platform operations.
What comes next
Organizers extended the first round because of the disruption, moving the cutoff from Saturday at 8 p.m. French time to Sunday at 6 p.m. The report also said that if a second round is needed, it will be held from Oct. 16 to Oct. 17.
