Europe’s Most Hackable Election

The EU faces hackers, trolls and foreign agents as it gears up for a vote in May. Three years after Russian disinformation campaigns disrupted the 2016 US presidential election and possibly influenced the result of the Brexit vote, European officials are worried the European Parliament election in May is next.

“In 2016 we stopped being naive,” said Liisa Past, a former chief research officer at the Estonian Information System Authority who coordinated security preparations across Europe last year. “Since then we have tested national systems for the security environment as we now know it. But the last European election was 2014 and that system hasn't been tested in this new security environment.”

The election, in which voters in 27 countries will install a new European Parliament and by extension a new crop of top EU officials, is uniquely vulnerable, officials say.

“Given the dispersed nature and comparatively long duration of the European Parliament elections, they present a tempting target for malicious actors,” European Commissioner for Security Julian King told Politico. “Everyone needs to take responsibility for this, a system is only as secure as the weakest link in the chain.”The “European election” is in fact a series of simultaneous elections that will take place on May 23-26, in which the integrity of the vote depends on how 27 national governments fend off hackers and other threats. 

While some governments are better prepared than others, it would only take one successful act of disruption to cast doubt on the composition of the next European Parliament.

“A successful campaign against one-member state that includes cyber-enabled elements could mean that the assignment of seats cannot be confirmed thus compromising the entirety of election processes,” said a recent EU report into the cyber risks to the election. A security incident "could impact the ability of the European Parliament to convene and thus could affect the very functioning of the European Union.”

Threats to the integrity include disinformation campaigns, cybersecurity breaches and digital tampering with the outcome of the votes.

Trolling the Election
Experts are most worried about the threat of disinformation. In Europe, automated bots, sometimes backed by governments, have shaped and shifted the online conversation.

Bots have been used to influence the debates regarding independence in Catalonia and immigration in Italy. Misinformation linked to Russia's Internet Research Agency in St. Petersburg was deployed in the Netherlands to influence Dutch opinion against Ukraine, investigative news website Bellingcat reported. Disinformation and "fake news" has also been weaponised by domestic groups, used to influence the discussion around the Yellow Jacket protests in France and derail the hotly debated UN migration deal.

“If you're successful in your information operations you don't need to do decent cybersecurity or operational security,” said Past. Using disinformation “is the lower-hanging fruit right now,” she said. The proliferation of fake news is a top concern among European citizens, according to a poll conducted in September: Seventy-three percent of respondents said they are concerned or very concerned about disinformation or misinformation.

Companies like Twitter and Facebook acknowledge that fake accounts are a threat to the integrity of elections. Twitter added figures on “platform manipulation” in 2018 to its biannual transparency reports, hoping to increase public understanding of what it calls "attempts to disrupt the health of the public conversation via malicious automation and spam tactics."

Between January and June 2018, the social media company detected more than 232,450,000 suspected fake accounts worldwide (the company doesn’t provide a regional breakdown of the data). Seventy-five percent of the accounts were eventually suspended.

Under pressure from the European Commission, social media platforms adopted a fake news code of practice. Google, Facebook, Twitter and Mozilla and a range of umbrella associations and industry groups are expected to release new figures on their fight against disinformation later this month.

The report will include social media companies’ statistics on who has bought political advertisements, deployed fake news campaigns or spread disinformation through bot accounts and so-called troll farms. The tech firms will provide monthly updates from now until May.

"The European Commission's exercise of soft power has already pushed the platforms further than is legally required of them," said Rasmus Kleis Nielsen, director of the Reuters Institute for the Study of Journalism. Tech companies are often not legally liable for what happens on their platforms — though electoral law is slowly being updated to include the online sphere.
But, Nielsen added, “commitments of more transparency, public scrutiny and third-party compliance are vague still.”

The Commission also asked national authorities to monitor disinformation and share their findings with other EU capitals through a “rapid alert system” that would be set up by March and would warn countries and media about a wave of fake news stories.

Data Dumps
With just months to go before Europeans head to the polls, recent news from Berlin highlighted another threat to the integrity of the May election: the hacking of politicians' data. German authorities this month arrested a 20-year-old student who confessed to having illegally accessed information about more than 1,000 public figures, including high-ranking politicians like the country's president, Frank-Walter Steinmeier, Green Party leader Robert Habeck and Chancellor Angela Merkel.

The German breach is just the latest report of IT networks getting hacked, and its provenance illustrates just how easy it can be for cyber crooks to gather sensitive information that can disrupt a campaign. The investigation is ongoing, but Seehofer indicated that the hacker took advantage of politicians' poor password security to access a handful of online accounts to gather private conversations, mobile numbers and other personal information.

“The European political parties are one of the potential weak links,” said Fabrice Pothier, senior adviser for the Transatlantic Commission on Election Integrity. In addition to careless politicians allowing hackers access to sensitive information, he said there’s a lack of transparency in how foreign influencers fund and support political parties in Europe.

The source of the threat is widespread. Political rivals have an interest in hacking each other, in a modern-day version of the Watergate scandal. And cybersecurity companies, too, have an interest in demonstrating their services and counter-services in election times.

US intelligence officials have accused Russia, China, Iran and North Korea of seeking to influence the country’s election process. And the German hack revealed that even so-called script kiddies acting alone can be a threat.
Microsoft said technologies used in 11 EU countries shows the majority of governments stick to paper ballots and counting on paper. But many countries keep a voter registry online and disseminate results of the vote on the web.
Countries like Belgium use voting computers for some citizens to cast their ballot, and many use electronic means to aggregate votes, whether it is to count paper ballots or send the result from local polling stations to a central electoral authority that does a final count.

Estonia is the only EU country allowing for citizens to cast their vote online through its “i-voting” system. The tech-savvy country uses similar security checks deployed for a series of e-government services and claims the process is largely safe from hacking.

Some countries like the Netherlands and Germany previously decided to cut computers from large parts of its electoral process. The Netherlands did so in 2017, after years of back-and-forth between the election organizers and hacktivists that kept coming up with new vulnerabilities.

The European Commission has gathered national electoral councils for a meeting next Monday in Brussels. It is the first gathering of the councils since the Commission announced its plans to beef up election security in September. A second meeting is scheduled for February.

Politico

You Might Also Read:

Neither US, Russia Or China Will Sign Macron's Cyber Pact:

 

« Connecting African IT & Software Developers With Top Tech Companies
How Blockchain Technology Can Improve US Infrastructure »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Mielabelo

Mielabelo

Belgian consulting firm providing services in the security and compliance of information systems and IT service management.

National Security Agency (NSA)

National Security Agency (NSA)

NSA is a US intel agency responsible for the protection of government communications and information systems against penetration and network warfare.

Crest International

Crest International

Crest is focused on professionalizing the technical cyber security market whilst driving quality and standards of organizations that operate within it.

Adlink Technology

Adlink Technology

ADLINK is a leading provider of embedded computing products and services for applications including IoT and industrial automation.

Paygilant

Paygilant

Paygilant’s disruptive technology is designed to protect mobile payment  financial transactions against fraudulent attacks, whether executed by NFC, QR code, P2P or in-app.

Crosscheck Networks

Crosscheck Networks

Crosscheck products allow you to test your APIs across different protocols and message formats with functional automation, performance, and security testing capabilities.

ThreatQuotient

ThreatQuotient

ThreatQuotient delivers an open and extensible threat intelligence platform to provide defenders the context, customization and collaboration needed for increased security effectiveness.

National Cyber Security Centre (NCSC) - New Zealand

National Cyber Security Centre (NCSC) - New Zealand

The role of the NCSC is to help New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber-borne threats.

GB Group (GBG)

GB Group (GBG)

GBG is a global technology specialist in fraud, location and identity data intelligence.

WhiteHawk

WhiteHawk

WhiteHawk is the first online Cyber Security Exchange. We help you understand your cyber risk and match you to tailored and affordable solutions.

Ethyca

Ethyca

Ethyca builds automated data privacy infrastructure and tools for developers and privacy teams to easily build products that comply with GDPR, CCPA Privacy Regulations.

Componolit

Componolit

Componolit GmbH is a highly specialized company with a strong emphasis on trustworthy software, component-based systems and formal verification.

SecurIT360

SecurIT360

SecurIT360 is a full-service specialized Cyber Security and Compliance consulting firm.

NORMA Cyber

NORMA Cyber

NORMA Cyber delivers centralised cyber security services to Norwegian shipowners and other entities within the Norwegian maritime sector.

SecureWeb3

SecureWeb3

SecureWeb3 helps businesses and brands to secure their Web3 presence by offering a full suite of security services including training, consultancy & brand protection solutions.

Options Technology

Options Technology

Options is a global leader in financial technology, specialising in Capital Markets technology and enterprise-grade solutions.