Attacks against elections are inevitable – Estonia shows what can be done
- Written by Liisa Past, Next Generation Leader, McCain Institute for International Leadership, Arizona State University
Kremlin-backed attackers are working to influence the upcoming[1] European Parliament elections[2], according to cybersecurity firm FireEye[3]. A hacking campaign has targeted governments and political organizations[4] as well as think tanks and nonprofits[5], including prominent ones such as the German Council on Foreign Relations, the Aspen Institute and the German Marshall Fund[6], as Microsoft has reported.
These new reports highlight rising fears[7] of digital attacks on democracy[8] around the world, including on the U.S. presidential elections in 2020.
Potential targets include election technology such as voter lists, computers that tally the votes and websites that report results to the public. But the threats go farther, to cyber campaigns against institutions supporting democratic processes like political parties, think tanks and the media, as well as information warfare targeting public opinion[9].
Old problem of election interference
Russian interference in the West is not new[10]. The experiences of Estonia – the first country ever victim[11] to a clearly coordinated and politically motivated cyber operation – can inform American and European defenses to these complex threats.
Together with its neighbors Latvia and Lithuania, Estonia has won international recognition for the effectiveness of its defenses[12] against politically motivated hacking and disinformation, which combine government, industry and public efforts. In the parliamentary elections of March 3, 2019, Estonians showcased the confidence they have in their country’s digital security[13].
Three days before Election Day, close to 40 percent of those eligible had already cast their vote. Most of those early voters[14] did so online, and 44 percent of the total votes[15] were cast over the internet.
Preparing to defend
This recent Estonian election was largely unaffected by cyberattacks or coordinated information operations. Some of the reason is likely because the country and its people have improved their understanding of the problems, and their defenses against it, over the past couple of decades.
Back in 2007, the relocation of a Soviet-era memorial in the Estonian capital Tallinn resulted in public protests and several waves of coordinated distributed denial of service[16] attacks. These did not steal citizens’ data, but they did shut down many digital services[17] for a number of hours on each of several days. This highlighted both the public’s increasing reliance on digital technology and the weaknesses of online systems.
The digital systems that Estonian governments and businesses have developed in the years since 2007 are strong, secure and trusted by users – who welcome further digitization of their lives because it is convenient and safe. Electronic banking systems, digital medication prescriptions[18], e-schools[19] and thousands of other online services rely heavily on government-backed secure digital identity[20], a digital population registry[21] and a robust data exchange layer[22] between databases and services.
These systems also facilitate the digital elements of elections[23], including internet voting[24].
Election security experts from around the world examine, in public, the computer used to tally the online votes from Estonia’s parliamentary elections in March 2019.
Erik Peinar/Estonia State Electoral Office
Comprehensive cyber defenses
A key lesson from Estonia is that with so many different threats, no single defense can protect every part of a democratic system and society. Rather, defenders must evaluate what attackers are likely to be after – and what’s at stake.
In 2017, two Estonian government agencies, the State Electoral Office and the Information System Authority – where one of us, Liisa Past, was chief research officer for cybersecurity – joined forces to comprehensively analyze the threats and risks to local elections. In addition to the technical risks, like failures in connections or flaws in software, the team paid close attention to issues in management as well as the possibilities for information warfare[25].
A 64-page document assessed many of the online risks to Estonia’s cybersecurity.
Estonia Information System Authority[26]
The Estonian government engaged in similar analyses in the lead-up to the 2019 elections. In addition, the agencies took a lesson from the French[27] and U.S. experience in 2016[28] and taught political parties and individual candidates how to protect themselves and their information online.
Similarly, governments across the European Union are sharing their best ideas[29] about designing trustworthy election systems. Logging and monitoring network access, for example, can help computer administrators quickly detect and respond to unauthorized activity.
Understanding the double threat of information operations
Estonia’s lessons may be useful elsewhere. In the past five years, Russian attacks have targeted both election-specific systems, like the Ukrainian national election commission website[30] in 2014, and the larger public discussion[31] around the election and current political issues.
Online efforts seeking to manipulate people’s views[32] in the run-up to the 2016 Brexit vote[33], as well as during presidential campaigns in the U.S. and France[34], are quite similar to Cold War tactics known as “information operations[35].”
The practitioners use 21st-century tools like social media[36] and automation[37] to plant false stories and exploit social divisions[38]. They don’t necessarily seek to break through network firewalls or compromise any secure government systems, but rather appear to unwitting online audiences as authentic fellow contributors[39] in a free, open debate.
Bots’ characteristic behaviors[40] can give them away. Yet there are so many of them[41] that they can crowd out human voices and undermine the democratic principle of real participation by actual people[42].
Defense in depth
Elections’ legitimacy depends on more than just technical security. They must also be seen to be free of external influence. Governments should take comprehensive views of their security, and threats to it – accounting for elements as diverse as cyber defenses of essential systems and the effects of information warfare on voters.
It’s a worldwide problem, with Russia exerting influence not just in the U.S. and Estonia but also Egypt[43], and China attacking Australia[44]’s political system.
The response, therefore, has to include open, healthy public debate and media literacy[45] as well as preventing, detecting and mitigating the effects of cyberattacks on the confidentiality, availability and integrity[46] at the very core of democratic systems.
References
- ^ working to influence the upcoming (www.zdnet.com)
- ^ European Parliament elections (www.europarl.europa.eu)
- ^ cybersecurity firm FireEye (www.cnbc.com)
- ^ targeted governments and political organizations (www.zdnet.com)
- ^ think tanks and nonprofits (www.reuters.com)
- ^ German Council on Foreign Relations, the Aspen Institute and the German Marshall Fund (blogs.microsoft.com)
- ^ rising fears (news.sky.com)
- ^ digital attacks on democracy (www.washingtonpost.com)
- ^ public opinion (theconversation.com)
- ^ not new (www.pbs.org)
- ^ first country ever victim (www.europeaninstitute.org)
- ^ effectiveness of its defenses (theconversation.com)
- ^ confidence they have in their country’s digital security (www.euractiv.com)
- ^ Most of those early voters (www.valimised.ee)
- ^ 44 percent of the total votes (www.valimised.ee)
- ^ several waves of coordinated distributed denial of service (ccdcoe.org)
- ^ shut down many digital services (www.wired.com)
- ^ digital medication prescriptions (www.haigekassa.ee)
- ^ e-schools (www.kyivpost.com)
- ^ government-backed secure digital identity (www.id.ee)
- ^ digital population registry (www.siseministeerium.ee)
- ^ robust data exchange layer (www.ria.ee)
- ^ elections (www.valimised.ee)
- ^ including internet voting (www.valimised.ee)
- ^ possibilities for information warfare (www.hybridcoe.fi)
- ^ Estonia Information System Authority (www.ria.ee)
- ^ from the French (www.nytimes.com)
- ^ U.S. experience in 2016 (www.cnn.com)
- ^ governments across the European Union are sharing their best ideas (www.ria.ee)
- ^ national election commission website (phys.org)
- ^ larger public discussion (www.hybridcoe.fi)
- ^ manipulate people’s views (theconversation.com)
- ^ Brexit vote (www.telegraph.co.uk)
- ^ France (firstmonday.org)
- ^ information operations (globalsecurityreview.com)
- ^ social media (www.nytimes.com)
- ^ automation (www.recode.net)
- ^ exploit social divisions (hub.jhu.edu)
- ^ authentic fellow contributors (www.scientificamerican.com)
- ^ Bots’ characteristic behaviors (www.sotrender.com)
- ^ so many of them (qz.com)
- ^ real participation by actual people (www.theguardian.com)
- ^ also Egypt (theconversation.com)
- ^ China attacking Australia (theconversation.com)
- ^ open, healthy public debate and media literacy (ec.europa.eu)
- ^ confidentiality, availability and integrity (www.ria.ee)
Authors: Liisa Past, Next Generation Leader, McCain Institute for International Leadership, Arizona State University
