=== Happy February 2020! It’s all kicking off and the Iowa caucuses is throwing up lots of interesting results for the Democrats to ponder. Should they stick with what they know or go for an agent of change? The technical glitches in the voting app have left a lot of people confused and upset (except President Trump!). Even when you’re trying to do things right, new technology can throw up a lot of very tangible challenges. But there’s more to it than that…

In recent years, elections have become an increasingly frequent target of cyber attacks in the modern digital era, coming under attack across the globe. Along with this, the criminal landscape has transitioned from traditional crime groups to large organised nation state crime groups. With elections becoming increasingly dependent on modern technology, cyber issues have become more prevalent and so cyber security has become a vital shield against election violence and manipulation. Cyber attacks present a growing threat to both nascent and mature democracies, as they shape the election process, erode citizen trust and trigger other forms of election violence. Cybersecurity is now one of the greatest electoral challenges (assuming that the other tech works!), with motivations of cyber crime ever changing, the prime aim of most organised groups is to achieve political disharmony or illegally obtain an unfair result. Cyber crime has impacted a number of previous elections, for example, in 2016, Russian hackers made extensive efforts to interfere with the voting process during the Presidential election.

Cyber crime poses a major threat to the 2020 US Presidential Election, and the biggest challenge is convincing people to prioritise security over familiarity, convenience and accessibility. Already, it has been found that 1 in 4 US voters were considering not voting in upcoming elections due to concerns for their personal data being stolen from election data bases by cyber criminals. There is the ever increasing risk of exposure to malicious attacks focusing on derailing or discrediting an election, particularly now with the US government being on high alert for Iranian cyberattacks retaliating for a US military strike that killed a top Iranian official. Typical threat actors include the likes of: nation states, criminals, insiders, hacktivists and politically motivated groups. Election time is very attractive due to the number of motivations, such as: financial gain, fame and reputation, or probably more alarmingly, provoking chaos as the result of a far-reaching foreign policy/ national interest which revels in sowing social divisions within stable democracies. The cyber threats have been enhanced with North Korea, Iran and Russia having already launched more than 2,700 phishing attacks against presidential campaigns and other high value targets in the last year alone. There are numerous types of cyber issues that the 2020 US presidential Elections faces, all with ulterior motives and results:

1. Distributed denial-of-service attack (DDoS attacks):

DDos attacks are a malicious attempt to disrupt normal traffic of a targeting service of the network by flooding online resources with so many requests that the service becomes very slow or completely unavailable. DDoS attacks can interfere with the likes of websites or communication systems from anywhere in the world, making it extremely difficult to find the culprits. In elections, they have the potential to interfere with all election-related technology, such as: voter registration technologies, voting, vote counting technologies, websites for result publication and even the likes of private email accounts. They are also very simple to execute, cheap and very destructive, which is why they are arguably the most common type of cyber attack when it comes to political elections. In elections, a DDos attack has the potential to put a candidate at a major disadvantage, especially if planned to attack at a critical campaign time.

2. Malware and Ransomware

Malware and ransomware attacks have the potential to make essential election systems and critical election data inaccessible and are one of the most common tactics used by malicious foreign actors. In particular, US officials fear the possibility of a ransomware attack against the 2020 election, due to its great potential to manipulate, disrupt or destroy critical data. Cybersecurity experts, including the highest ranking cyber security official at the US Department of Homeland Security, worry that cyber criminals could use ransomware to lock up the voter registration databases maintained by states. The Cybersecurity Infrastructure Security Agency (CISA) has developed a major initiative to work alongside local election officials to help protect voter registration databases against ransomware attacks.

3. Social Media Enabled Disinformation

Disinformation is the act of deliberately spreading false, misleading or inaccurate information with the intent to cause harm by influencing public opinion. There are a number of predictions about where disinformation will come from during the 2020 election, such as: the deployment of ‘Deep Fake’ videos, threats from Iran and China, social media in general as well as for profit firms abroad and in the US who will be hired to generate disinformation. Typically the US law forbids foreigners taking part in American political campaigns, however, Americans are allowed and encouraged to take part in their own democracy. This therefore complicates the electoral process due to a technical challenge that domestic meddling does not leave obvious markers, so it is left unclear whether it’s bad-faith meddling or not.

In October 2019, Facebook announced that it removed ‘four separate networks of accounts’ linked to coordinated inauthentic behavior, 3 networks originated in Iran and the other in Russia. Previous reports indicated that in the previous election, Russian operatives used Facebook, Twitter and Youtube to sow division among American voters and boost Donald Trump’s presidential campaign. Social media platforms were being used in an attempt to do more to combat foreign election interference. In August 2019, Facebook and Twitter banned advertisements that use misinformation to attempt suppression of voter turnout. As of 2019, a few countries have specific ‘fake news’ legislation put in place.

4. Electronic Voting

Let’s forget about Iowa for the moment! Over the last 17 years or so, electronic voting has become an integral part of the electoral process. Electronic voting can entail using either standalone electronic voting machines, paper-based electronic voting systems or computers connected to the Internet. All have posed great problems in the years they have been in use. Originally electronic voting was justified by State Officials who believed the move was the best way to satisfy an impatient public that crave instantaneous results, with nearly two thirds of people saying they would be more likely to vote online if they could do so. However, is this a good enough reason to risk the security of the public?

During the 2016 election, Russian hackers made extensive efforts to infiltrate American electronic voting apparatus, there is therefore the persistent worry that foreign threats will not hesitate to interfere with the 2020 voting apparatus.

It has been further revealed by DefCon that nearly half of US states are using voting machines that have known software vulnerabilities, particularly those connected to the internet. While there has been a keen effort made by the computer science community and security researchers to fix these vulnerabilities, the systems remain susceptible to tampering, hacking and other security issues. During a DEFCON event in 2019, organiser tested a combination of electronic, paper based and hybrid versions of voting machines, the report found that older, paper based devices proved to be more secure from malicious hacks.

With the identification of a number of cyber issues to look out for in the run up to the 2020 US presidential election, it is important to put in place a way to protect oneself from further threats. In 2016, The Facebook Cambridge Analytica Scandal broke, which was the harvesting of personal data of millions of people’s facebook profiles without their consent and then using it for political advertising purposes. Cyber Security agencies and infrastructure security agencies have been developing major initiatives to work alongside local election officials in order to provide protection. Implementing basic cyber security measures has the ability to offer protection against a number of cyber threats. These measures include recommendations such as:

• Do not make sudden changes to existing infrastructure, software or choice of service providers which are relied upon during elections.
• Secure technology through regular reviews, audits and updates.
• Invest in human resources, staff training and cyber hygiene, assigning staff roles and responsibilities.
• Monitor online conversations on public social media, as well as the dark web, hacktivism forums and other resources.
• Establish criminal liability under the law for election malpractice and manipulation.
• Take regular backups of Electoral Management Systems data stores and hold them offline in a separate secure location.
• Keep systems, hardware and software well maintained, up to date and patched.
• Offer guidance for how to respond to the threat of a cyber attack.
• Voters should avoid sharing details relating to their role in elections, particularly online and on social media.
• Be vigilant and report any unusual or unexpected behaviour

About Salt Communications

Salt Communications is a multi-award winning cyber security company providing a fully enterprise-managed software solution giving absolute privacy in mobile communications. It is easy to deploy and uses multi-layered encryption techniques to meet the highest of security standards. Salt Communications offers ‘Peace of Mind’ for Organisations who value their privacy, by giving them complete control and secure communications, to protect their trusted relationships and stay safe. Salt Communications is headquartered in Belfast, N. Ireland, for more information visit our website.