Europe’s most hackable election

It could happen here.

Three years after Russian disinformation campaigns disrupted the 2016 U.S. presidential election and possibly influenced the result of the Brexit vote, European officials are worried the European Parliament election in May is next.

“In 2016 we stopped being naive,” said Liisa Past, a former chief research officer at the Estonian Information System Authority who coordinated security preparations across Europe last year. “Since then we have tested national systems for the security environment as we now know it. But the last European election was 2014 and that system hasn’t been tested in this new security environment.”

The election — in which voters in 27 countries will install a new European Parliament and by extension a new crop of top EU officials — is uniquely vulnerable, officials say.

Click Here: cheap nrl jerseys

“Given the dispersed nature and comparatively long duration of the European Parliament elections, they present a tempting target for malicious actors,” European Commissioner for Security Julian King told POLITICO. “Everyone needs to take responsibility for this — a system is only as secure as the weakest link in the chain.”

The “European election” is in fact a series of simultaneous elections that will take place on May 23-26, in which the integrity of the vote depends on how 27 national governments fend off hackers and other threats. And while some governments are better prepared than others, it would only take one successful act of disruption to cast doubt on the composition of the next European Parliament.

“A successful campaign against one member state that includes cyber-enabled elements could mean that the assignment of seats cannot be confirmed thus compromising the entirety of election processes,” said a recent EU report into the cyber risks to the election. A security incident “could impact the ability of the European Parliament to convene and thus could affect the very functioning of the European Union.”

Threats to the integrity include disinformation campaigns, cybersecurity breaches and digital tampering with the outcome of the votes.

Trolling the election

Experts are most worried about the threat of disinformation.

In Europe, automated bots, sometimes backed by governments, have shaped and shifted the online conversation.

Bots have been used to influence the debates regarding independence in Catalonia and immigration in Italy. Misinformation linked to Russia’s Internet Research Agency in St. Petersburg was deployed in the Netherlands to influence Dutch opinion against Ukraine, investigative news website Bellingcat reported. Disinformation and “fake news” has also been weaponized by domestic groups, used to influence the discussion around the Yellow Jacket protests in France and derail the hotly debated U.N. migration deal.

“If you’re successful in your information operations you don’t need to do decent cybersecurity or operational security,” said Past. Using disinformation “is the lower-hanging fruit right now,” she said.

The proliferation of fake news is a top concern among European citizens, according to a poll conducted in September: Seventy-three percent of respondents said they are concerned or very concerned about disinformation or misinformation.

Companies like Twitter and Facebook acknowledge that fake accounts are a threat to the integrity of elections.

Twitter added figures on “platform manipulation” in 2018 to its biannual transparency reports, hoping to increase public understanding of what it calls “attempts to disrupt the health of the public conversation via malicious automation and spam tactics.”

Between January and June 2018, the social media company detected more than 232,450,000 suspected fake accounts worldwide (the company doesn’t provide a regional breakdown of the data). Seventy-five percent of the accounts were eventually suspended.

Under pressure from the European Commission, social media platforms adopted a fake news code of practice. Google, Facebook, Twitter and Mozilla and a range of umbrella associations and industry groups are expected to release new figures on their fight against disinformation later this month.

The report will include social media companies’ statistics on who has bought political advertisements, deployed fake news campaigns or spread disinformation through bot accounts and so-called troll farms. The tech firms will provide monthly updates from now until May.

“The European Commission’s exercise of soft power has already pushed the platforms further than is legally required of them,” said Rasmus Kleis Nielsen, director of the Reuters Institute for the Study of Journalism. Tech companies are often not legally liable for what happens on their platforms — though electoral law is slowly being updated to include the online sphere.

But, Nielsen added, “commitments of more transparency, public scrutiny and third-party compliance are vague still.”

The Commission also asked national authorities to monitor disinformation and share their findings with other EU capitals through a “rapid alert system” that would be set up by March and would warn countries and media about a wave of fake news stories.

Data dumps

With just months to go before Europeans head to the polls, recent news from Berlin highlighted another threat to the integrity of the May election: the hacking of politicians’ data.

German authorities this month arrested a 20-year-old student who confessed to having illegally accessed information about more than 1,000 public figures, including high-ranking politicians like the country’s president, Frank-Walter Steinmeier, Green Party leader Robert Habeck and Chancellor Angela Merkel.

“We’re facing European elections in May of this year,” Germany’s Interior Minister Horst Seehofer warned his fellow politicians in the aftermath of the breach. “I don’t want to conjure up or predict anything, but we have to brace ourselves for preventing attempts to influence those elections.”

The German breach is just the latest report of IT networks getting hacked — and its provenance illustrates just how easy it can be for cyber crooks to gather sensitive information that can disrupt a campaign. The investigation is ongoing, but Seehofer indicated that the hacker took advantage of politicians’ poor password security to access a handful of online accounts to gather private conversations, mobile numbers and other personal information.

“The European political parties are one of the potential weak links,” said Fabrice Pothier, senior adviser for the Transatlantic Commission on Election Integrity. In addition to careless politicians allowing hackers access to sensitive information, he said there’s a lack of transparency in how foreign influencers fund and support political parties in Europe.

The source of the threat is widespread. Political rivals have an interest in hacking each other — in a modern-day version of the Watergate scandal. And cybersecurity companies, too, have an interest in demonstrating their services and counterservices in election times.

U.S. intelligence officials have accused Russia, China, Iran and North Korea of seeking to influence the country’s election process. And the German hack revealed that even so-called script kiddies acting alone can be a threat.

“We shouldn’t be attacker-blind,” said Past, the Estonian electoral security expert. “Not everyone is this well-resourced, long-term thinking, nation-state-backed group. You have to take the full list of attackers into account.”

Hacking the ballot box

Then there’s the risk that the election results will be, well, literally hacked.

Experts have re-upped long-standing concerns on the security of IT systems used to cast, count and aggregate ballots.

For Europe, the risks are numerous, as countries procure their own equipment, and contingencies differ from country to country.

“Each member state will have their own vulnerabilities, and there hasn’t been an overall assessment done,” said Julia Schuetze, election security expert at the Berlin think tank Stiftung Neue Verantwortung who co-wrote a report on “Securing democracy in cyberspace” last October.

Research by U.S. technology giant Microsoft on technologies used in 11 EU countries shows the majority of governments stick to paper ballots and counting on paper. But many countries keep a voter registry online and disseminate results of the vote on the web.

Countries like Belgium use voting computers for some citizens to cast their ballot, and many use electronic means to aggregate votes, whether it is to count paper ballots or send the result from local polling stations to a central electoral authority that does a final count.

Estonia is the only EU country allowing for citizens to cast their vote online through its “i-voting” system. The tech-savvy country uses similar security checks deployed for a series of e-government services and claims the process is largely safe from hacking.

Some countries like the Netherlands and Germany previously decided to cut computers from large parts of its electoral process. The Netherlands did so in 2017, after years of back-and-forth between the election organizers and hacktivists that kept coming up with new vulnerabilities.

“There is awareness at political level but the problem is the fragmentation of the electoral systems,” Pothier said. “Some countries, certainly smaller ones, don’t have the means to fully secure their network … Others have weak electoral councils.”

The European Commission has gathered national electoral councils for a meeting next Monday in Brussels. It is the first gathering of the councils since the Commission announced its plans to beef up election security in September. A second meeting is scheduled for February.

“The EU Commission can’t do much for the next European election, it is too late,” Pothier said. “So it’ll come down to the capitals and their electoral councils.”

Laura Kayali and Janosch Delcker contributed reporting.