Critical infrastructures
What cyber threats could devastate elections this year, and how concerned should we as voters be about the integrity of our voting systems?
March 12, 2024
•
,
4 minutes Read
This year, billions of people will go to the polls to decide their next political leaders. From India to the United States, the results of these and other elections could influence the geopolitics of the coming years. With so much at stake, concerns about election interference are growing.
So what are the real and present cyber threats, beyond the threat of deepfake misinformation? What types of safeguards exist to demonstrate the integrity of voting systems? And how worried should we voters be?
What’s at stake?
In 2024, national or regional elections will be held in the US, EU, UK, India, Taiwan, South Africa, Mexico and many other countries. On paper, nation states, hacktivists, or even financially motivated criminals could target online election infrastructure to modify votes or interfere with voter registration databases to deprive individual citizens of their right of voting. Very. Or they could try to disrupt Election Day activity by targeting online machines or other pieces of infrastructure that could make it harder for people to get out and vote. Another scenario is attacks aimed at reporting results, in order to cast doubt on the outcome.
There is a lot at stake, then, in terms of external forces potentially changing or influencing election outcomes in order to get the candidate they want elected. But there is also good news.
The good news
Despite some claims that the 2020 US election was “stolen,” there is no evidence to support this. In fact, the US Cybersecurity and Infrastructure Security Agency (CISA) has released a long list of rebuttals to some of the most common rumors about election interference. They include statements that:
- Election officials regularly update voter registration lists to ensure they are as accurate and up-to-date as possible
- Various security measures exist to protect the integrity of mail-in ballots, including voter identity checks
- There are robust safeguards against tampering in place, with ballot papers returned via mailbox
- Federal, state and/or local election authorities rigorously test and certify voting machines and equipment for vulnerabilities
- signature matching, information checks, and other measures are designed to protect against voter impersonation and ineligible voters casting ballots
There is another reason to have confidence in the integrity of elections: In countries like the United States, there are different types of voting machines and recording technologies. These manage activities at all stages of the electoral cycle, including:
- pre-election activities: think about voter registration and the management of postal voting.
- election day: includes direct recording electronic (DRE) voting machines (where users cast a vote directly) and optical scan voting where paper ballots are scanned and votes counted. The results are then sent and centralized electronically.
- post-election activities: includes post-election audits and the publication of unofficial election night results on public-facing websites.
There is some concern about DRE machines if they could be compromised remotely. On the other hand, in the United States, as in many other countries, this is not the main way people vote. And the use of technology in general is so decentralized and diverse across the country that it would be extremely difficult for a single entity to hack and change enough results to effectively influence elections.
Where are the main threats?
However, there remain valid concerns that bad actors could locate a district or city in several swing states. Even if they cannot change the results, they could theoretically undermine confidence in the results by making it difficult for people to cast their votes or by interfering with the reporting of the results.
CISA identifies three main cyber threats:
- Ransomware: This could be used to steal and disclose voter registration data or deny access to sensitive information about voters and election results. It could also be used to disrupt key operational processes such as candidate registration and submission.
- Phishing: This is a particular threat to election officials, who need to open email attachments during their daily work. Threat actors could easily disguise malicious payloads with social engineering lures that exploit electoral themes. The result could be a hidden download of ransomware, information-stealing malware, or other malicious code.
- Denial of Service (DoS): Distributed Denial-of-Service (DDoS) attacks could prevent voters from accessing key information that would help them vote, such as the location of the nearest polling station or information about major candidates. Indonesia’s General Election Commission said it recently suffered an “extraordinary” number of such attacks on its site and other sites during the national elections.
Keep elections safe
The good news is that the topic of election security is now widespread, with CISA offering numerous resources to electoral bodies, which administrators in other countries could benefit from. The safest form of voting, obviously, is paper voting. And this is how most ballot papers are cast in many countries, including the UK, EU and US. But as long as voter registration and election infrastructure are targeted, concerns will persist.
In this context, best practices to mitigate the threat of phishing, ransomware and DoS will remain valid. They include regular penetration testing and vulnerability/patch management programs, multi-factor authentication (MFA), and network segmentation. Fortunately, there are also numerous providers on the market that offer cloud-based DDoS mitigation, phishing detection, and rapid ransomware response.
In many ways, the greatest threat to election integrity will be disinformation campaigns, including deepfakes. And hack-and-leak attempts to influence public opinion in the run-up to voting day, as happened before the 2016 US presidential election. Many of us will be hoping that wherever we vote and whatever happens , the result will not be in question.