Activism, hacking or campaigning: Why it’s so easy to win the popular vote at Eurovision

On Saturday night, Austrian singer JJ won Eurovision Song Contest with his song Wasted Love. But the prize nearly went to Israeli singer Yuval Raphael, which won the public vote but slipped to second place thanks to the jury vote.

Since the results were announced, questions have been brewing over why Raphael won the public vote, given the widespread criticism of Israel’s war in Gaza. Televoting in Eurovision, however, is vulnerable to different strategies.

Journalist and Eurofan Juan Carlos Piña visited the Eurovision website to vote on Saturday. “When you log in, it asks you for your country, and then all the candidates appear, with a note saying you can cast a maximum of 20 votes,” he says. He chose four votes for his favorite candidate, Armenia, and went to the next page, where he was asked for an email address and a bank card. Each vote from Spain online cost €1.09. Telephone and text messages were slightly more expensive.

“After putting in the card details, the card is verified and the votes are supposed to be cast,” Piña adds. “I never had to identify myself with my first and last name,” he says. Each user could therefore cast 20 votes with one bank card and one email address. The system didn’t send a message to verify that the email address was real. So, what would be needed to vote another 20 times? Just another bank card and another email address.

This deduction doesn’t require much thinking. Eurovision’s own website hinted at it right after voting, as shown by screenshots thanking users from several countries: “Thank you for voting! We appreciate your contribution! Each payment card is limited to one transaction, regardless of the number of votes cast. To vote again with another card, please return to the voting summary to select new votes.”

Electronic voting is a laborious tool that is rarely used in more sensitive processes due to its complexity and lack of transparency.

“Electronic voting refers to voting via an electronic ballot box — what they’ve done in Eurovision is more like a simulation of online or remote voting,” says Justo Carracedo, a pioneer of electronic voting research in Spain. “For something to be considered a vote, the group of eligible voters must be clearly defined, and it must be guaranteed that each person votes only once. Without this detail, the word ‘vote’ is being misused.”

The ease with which a mobilized group of voters can game the system is astonishing. In Spain, according to Spain’s public broadcaster RTVE, 111,565 online votes were cast during the Eurovision final, along with 7,283 by phone and 23,840 via SMS.

What’s more, for Israel to receive Spain’s 12 points — the highest amount — from the public vote, it only had to be the most voted-for entry. A group of people rallied around a cause — whether for Israel or Ukraine — can easily tip the scales with just a few credit cards. While most voters choose based on musical preference or general sympathy — leading to more dispersed voting — the mobilized group votes strategically, en masse, for their candidate, pushing them to the top of the rankings.

“Mobilization is important,” says Luis Panizo, a professor at the University of León. “But what concerns me is that no electronic voting system is secure if it isn’t verifiable, and to achieve that, it must be transparent in how it operates. All the details of its operation — its code, the vote processing and storage systems, the counting, the details of the transmission of the record, and the publication of the results — must be known before, during, and after the results. Otherwise, it can’t be audited. You can’t do a forensic audit if you haven’t been involved in the entire process.”

This technical complexity opens the door to other possibilities — though none can be proven from the outside, and likely not even now, after the contest has ended. A traditional hack, while hard to carry out without leaving a trace unless extraordinary measures are taken, cannot be ruled out.

Some have suggested coordinated ad campaigns on social media. EL PAÍS has seen advertisements on TikTok, Facebook, and Instagram promoting several artists, but none appeared to have a major impact. Of course, mass messages can also be forwarded via email or WhatsApp. The effect would be similar to that of a highly mobilized group: the fact that this is the second year in a row it’s happened with Israel — following the October 2023 attacks — may point to the origin of the campaign.

A handful of companies have developed more or less sophisticated electronic voting systems. According to Panizo, the best of them haven’t been especially successful. “Recently, more than 20 companies offering remote voting have popped up. We’ve audited some, and the best ones don’t get hired. Not because they’re slightly more expensive, but because people prefer ease of use and access to early statistics over a system that is closed, auditable, and verifiable,” he explains.

The company responsible for managing Eurovision’s voting is the German firm Once, whose core business isn’t remote voting but “creating and applying technology for live interaction during peak voting times.”

Eurovision’s main concern is that all users can vote — and pay — within the brief voting window. To make that happen, Once builds a system designed to ensure that users are human, blocking bots and malicious attacks. If some of those users happen to be government employees in a specific country using a VPN — services that allow users to appear as though they’re in another country — while these systems can detect that, it doesn’t appear to be a decisive factor.

Eurovision’s system allows mass voting by country, meaning a relatively small, determined group can make a big impact. “This kind of electronic voting has no real future. In serious elections, nobody trusts it. It’s used in clubs, associations, companies. People go for cheaper solutions — until the day something goes wrong,” Panizo concludes.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition