We measured the security of 2,210 Swiss public bodies. Ticino scores 42 out of 100

If tomorrow someone sent the residents of a Ticino municipality an email with the municipality's official sender address, asking them to pay an overdue tax into a new account, in most cases no rule published by the municipality would stop that message. This isn't a hunch: we measure it every morning. Only 16% of the 101 Ticino public bodies we track tell mail servers to reject or set aside fake messages sent in their name. In the rest of Switzerland the figure is 45%, which is still nothing to boast about.

The figure comes from the Swiss Public-Sector Security Census, an independent research project we run at Webcracy. Every day it checks the email and website security settings of 2,210 public bodies: the municipalities in the federal register, the cantons and the federal offices. It uses only information anyone can see on the internet, and each body's result is a score from 0 to 100. Today the national median is 56.

How it works

We don't run penetration tests on municipalities and we don't break into anything. For each body, the collector reads the public DNS records, attempts a TLS handshake for each version of the protocol, and downloads the home page and the security.txt file. At most one request per second per host, no logins, no forms. The home page is analysed in memory and then discarded.

These readings produce 17 measurements across five areas, weighted by what they protect. Email authenticity (SPF, DMARC and the reporting address) is worth 30 points, website encryption (TLS, HSTS, certificate validity) another 30, website security headers 15, DNS and contacts (DNSSEC, CAA, security.txt) 15, and encryption of mail between servers the last 10. A measurement that doesn't apply, or that failed on a given day, counts neither for nor against. The full methodology is public, with every weight and every threshold, and every change is logged with its date.

The easy part is done

The picture is fairly consistent: whatever you switch on once and then runs by itself is in place almost everywhere. 95% of bodies have a website that only accepts TLS 1.2 or newer, with a valid certificate. 94% have a correct SPF record.

The trouble starts where a decision is needed. SPF says which servers may send mail for a domain, but not what to do with a message that comes from an unauthorised server. That's DMARC's job, and here the numbers change: 1,001 bodies out of 2,210 have a policy that rejects or quarantines fake mail, 461 have one that merely observes (p=none) and 727 have none at all. The move from p=none to p=reject is the scary one, because if a newsletter or a business application sends on behalf of the municipality without being set up properly, from that day on its emails disappear. We understand the caution. But staying in observation mode for years amounts to having no protection.

HSTS tells a similar story. Almost every site answers over HTTPS, but only 29% tell the browser never to go back to HTTP for at least a year, while 837 bodies have a shorter policy. DNSSEC is active on one domain in three. Encryption of mail between servers, the kind that prevents messages from being read or diverted in transit, is almost absent: MTA-STS is published by 20 bodies, TLS reporting by 24. It's the area with the lowest average score, 11% of the available points.

Ticino

The median score of the 101 Ticino public bodies is 42, the third lowest in Switzerland, tied with Uri. Only Schaffhausen (36) and Neuchâtel (37) do worse; at the top are Appenzell Ausserrhoden (71) and Aargau (66). On the basic checks Ticino is in line with or above the average, with 97% on TLS and 94% on SPF. The gap lies entirely in the settings that need someone to look after them: DMARC at 16% against 45% nationally, HSTS at 11% against 29%, DNSSEC at 19% against 33%.

We don't think this says anything about the competence of the people working in Ticino's municipalities. One plausible explanation, which we haven't verified yet, is that many bodies rely on the same few providers, and that when a provider doesn't enable a protection, it doesn't enable it for any of its clients. If that's the case, it would be bad news and good news at the same time: a handful of conversations would be enough to raise the cantonal median by quite a few points.

What the census doesn't tell you

A low score doesn't mean a municipality has been breached, and a high one doesn't mean it's safe. We measure configurations visible from the outside, not how passwords, backups or staff permissions are handled. The list of domains has its limits too: the websites come mostly from Wikidata and haven't all been checked by hand, so a wrong domain can skew a body's result. That's why we accept corrections and apply them before the next measurement.

There's also a choice we made from the start: we don't publish results for individual bodies. The site only shows national and per-canton figures, never a ranking of municipalities. A list of names would get more clicks, but it would mainly serve people looking for targets and would embarrass people who often have neither the budget nor the authority to change things. For the same reason the project has no commercial purpose and no result can be bought.

---

For each of the six main checks there's a guide with the minimal fix, such as the one for DMARC, which explains how to go from no policy to p=reject in a few weeks without losing legitimate mail. The national and per-canton data can be downloaded as CSV and JSON under a CC BY 4.0 licence, updated daily. If you work in a public administration and think the domain associated with your organisation is wrong, write to us at contact@webcracy.ch.